What measures could be recommended to such providers
It's situational, it depends on the existing server and network infrastructure, and what magnitude of DDoS attack they're looking to protect against.
Existing DNS providers have publicized some of their solutions:
easyDNS suffered major DDoS attacks in 2005, and have since blogged about what they have done to become more resilient against DDoS. Their solution includes using Anycast'ed DNS clusters, and connectivity from providers like Prolexic who provide DDoS mitigation services. Their blog post is worth a read, and includes tips on how customers can help themselves.
Amazon Route 53 also uses Anycast, and serves DNS from 30+ locations world wide. The sheer size of their infrastructure helps.
Additionally, Amazon Route 53 is intentionally built with a large address space for their infrastructure. For example a name server lookup for a Route 53 customer might look like this:
AFAIK each of the above name server names points to an Anycast'ed server cluster. This may help to contain simpler attacks to a subset of Amazon's customers, and gives Amazon more options to mitigate an attack.
evaluate whether measures were effectively adopted by the provider
That's a good question. Enterprise providers like UltraDNS (Neustar) are presumably willing to provide NDA's and then discuss specifics of their implementation. But realistically, most less expensive providers aren't going to spend lots of time explaining their infrastructure to you. You can read their blogs, and maybe ask them a few relevant pre-sales questions about DDoS mitigation via email, but that's about it.
For smaller Internet based companies, who don't have lots of resources for DNS, a reasonable plan might be:
- Given that pure DNS hosting can be had for a few bucks per month, use two DNS providers together to be resilient against a provider failure. (NB: If you need proprietary features like Route 53's latency based routing, then this isn't possible.)
- Prefer DNS providers who have publicly confirmed having DDoS mitigation planning, for example by blogging about it, or who answer reasonably to presales emails on the subject.