Support Library
DNS Amplification Attacks
Open resolvers are abused as reflectors to amplify traffic toward victims.
Threat Model
Open resolvers are abused as reflectors to amplify traffic toward victims.
Attack Path
Small spoofed queries trigger much larger responses sent to victim IPs (reflection + amplification).
Detection Techniques
Track spikes in large-response queries and atypical outbound response volume patterns.
Mitigation Strategies
Close open recursion, apply response rate limiting, and enforce anti-spoofing controls.
Scoring Impact (tie to Panopticon scoring model)
Open resolver exposure maps to high/critical risk due to abuse potential.
How DNS Panopticon Detects This
- Relevant checks: Delegation integrity, resolver consistency, DNSSEC health, and suspicious record-pattern checks.
- Severity mapping: Informational, medium/high, or critical based on exploitability and user impact.
- Score impact: Reliability and security scoring dimensions are reduced according to blast radius.
- Related findings users will see: NS drift, validation failure, orphaned CNAMEs, wildcard exposure, and policy misconfiguration alerts.
Operator Checklist
- Verify behavior from at least two public resolvers and one resolver inside your own network before making changes.
- Make one change at a time, capture before/after query output, and wait for TTL windows to clear so you can confirm impact.
- Document the root cause and the final fix in your runbook to shorten future incidents.