Best Current Practices for DNS Resolver Resilience Against Coordinated Amplification Attacks

Abstract

This document describes an attack vector, exemplified by the "DNSBomb" attack, that leverages the emergent behavior of several widely- implemented DNS resolver mechanisms. By combining query timeouts, query aggregation, and response timing, an attacker can turn a set of resolvers into powerful amplifiers for a Pulsing Denial-of-Service (PDoS) attack. This attack is difficult to detect due to its low average traffic rate but can be highly effective at overwhelming a target's resources.¶

This document provides operational guidance and a set of best practices for DNS resolver implementers and operators to mitigate this threat. The goal is to harden the DNS ecosystem by reducing the potential for resolvers to be used in such a coordinated fashion, thereby improving the operational resilience of the DNS.¶

1. Introduction

The Domain Name System (DNS) [RFC1034] [RFC1035] has long been used as a vector for reflection and amplification attacks [RFC5358]. A sophisticated variant, the Pulsing Denial-of-Service (PDoS) attack [Shrew], uses intermittent, high-volume traffic bursts. This pattern makes PDoS attacks challenging to detect with conventional traffic analysis, yet they remain highly effective.¶

The "DNSBomb" attack [DNSBomb] demonstrates a practical method for generating such bursts by exploiting the combined, emergent behavior of standard resolver features. The attack model does not rely on a single protocol vulnerability but on the operational ambiguity in how resolvers should handle a specific sequence of events: a large number of queries from a single source for a domain whose authoritative server is slow to respond.¶

This document specifies best practices for resolver implementations and configurations to mitigate this and similar attack vectors. These practices are designed to limit the ability of an attacker to accumulate and concentrate responses without negatively impacting legitimate use cases.¶

2. Terminology

Pulsing DoS (PDoS) Attack:

A Denial-of-Service attack characterized by intermittent, short bursts of high-volume traffic separated by periods of little or no attack traffic.¶

Query Accumulation:

An attack phase where a resolver receives and holds numerous queries, typically from a spoofed source IP, while awaiting a delayed response from a malicious authoritative nameserver.¶

Response Concentration:

The near-simultaneous transmission of a large number of DNS responses from a resolver to a single target. This is the culmination of the attack, forming the traffic pulse.¶

Response Pacing:

A mitigation technique whereby a resolver deliberately de-synchronizes the transmission of a large batch of responses to a single client to prevent a traffic spike.¶

3. Attack Model

The attack model assumes the adversary can send IP-spoofed DNS queries and controls an authoritative nameserver for a domain. The attack proceeds in three phases:¶

1. Accumulation: The attacker sends a low-rate stream of queries for unique subdomains of their controlled domain to one or more recursive resolvers. The source IP address is spoofed to that of the victim. The attacker's authoritative server receives the upstream queries from the resolver but deliberately withholds its response. The resolver's query timeout window (potentially extended by IP defragmentation timeouts [RFC0791]) becomes the accumulation period.¶
2. Amplification: The attacker leverages query aggregation within the resolver to minimize the upstream query load on their authoritative server. When the attacker finally responds, it sends a large response, using EDNS(0) [RFC6891] to maximize the payload size. This single large response will be used as the basis for responding to all accumulated queries.¶
3. Concentration: Upon receiving the single, delayed response, the resolver unblocks all pending client-side queries. Due to optimizations for low latency, many resolvers will transmit all of these responses to the victim's IP address nearly simultaneously, creating a powerful, concentrated traffic pulse.¶

4. Problem Statement

This attack vector arises from an operational ambiguity in current DNS specifications. While features like query timeouts, aggregation, and fast response are individually beneficial for performance and resilience, their interaction under specific, maliciously crafted conditions is not well-defined. Resolvers lack clear guidance on how to differentiate between a legitimate, large-scale query event (e.g., from a large NAT) and a coordinated attack. This document aims to provide that guidance to reduce the potential for exploitation.¶

5. Mitigation Strategies and Operational Guidance

To mitigate this attack vector, this document recommends a set of interrelated strategies for resolver software and its operation.¶

References