DNS flood attacks

A DNS flood is a type of DDoS attack that overwhelms a domain’s DNS servers, disrupting DNS resolution and compromising a website’s ability to respond to legitimate requests. DNS servers are like phonebooks of the Internet, translating memorable website names like google.com into server addresses expressed as a series of numbers, like 193.162.0.1. DNS flood attacks often come from many unique locations, making it difficult to distinguish from normal heavy traffic. This could lead to a server failure and, in certain instances, cause a complete network outage.

DNS flood attacks use high-bandwidth connections of IoT devices like smartwatches and smart refrigerators to directly overwhelm DNS servers of major providers. Unlike DNS floods, DNS amplification attacks reflect and amplify traffic off unsecured DNS servers to hide the attack’s origin and increase its effectiveness. DNS amplification attacks make many small requests for large DNS records, but forge the return address to be that of the intended victim. The attacker may choose this route to obtain entry to confidential information or eradicate significant files on your website, rendering it inaccessible to users or clients.

To mitigate DNS flood attacks, large and highly distributed DNS systems that can monitor, absorb, and block attack traffic in real-time are needed. Until compromised IoT devices can be updated or replaced, this is the only way to withstand these attacks. Cloudflare’s DDoS Protection is an example of such a system that protects against DNS flood attacks.

Looking to learn more? We suggest heading over to Cloudflare’s Learning Center for an in-depth look at DNS flood attacks.