So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think).
DNS Flood - Sending a lot (lot means really lot; may be millions or even more) of queries (mainly random queries) to the DNS server with the intention of bringing down the services is a DNS Flood.
As DNS queries are mainly of UDP in nature (except DNSSEC or Zone Transfer or few others) and spoofing UDP packets is not a rocket science; so we can consider DNS Flood can be achieved easily.
There are multiple methods available for the DNS administrator to protect the resources from flood attack like- Rate Limiting, running servers in anycast mode and many other.
DNS Amplification - In this, attacker use to flood the victim machine/bandwidth through the DNS answers, which are replied by the OpenResolvers.
In nutshell, attacker use to send the random queries to the millions of OpenResolver, with the source IP of the victim (as packet is udp, so spoofing an ip address is not a challenge). OpenResolver in turn replies and answer is sent to the victim.
Could a DNS Amplification be used to DOS a DNS Server? [DNS Server A] attacks [DNS Server B] which attacks [DNS Server C] and so on...
Would it not work because of the different protocols? (TCP and UDP)
As explained above, In a DNS Amplification attack,
- Attacker [having ip address 126.96.36.199], use to send DNS queries [having ip address 188.8.131.52]
- In DNS packet, Src IP address is of victim's address [lets say 184.108.40.206]
- DNS Server on receiving the query [having ip 220.127.116.11] will reply to victim [18.104.22.168]
- Although victim [22.214.171.124] didn't ask for any dns record from [126.96.36.199] but it is getting the packets
Now, suppose a case where millions of OpenResolvers are sending DNS responses to the victim. This attack will have a potential to choke the victim's bandwidth along with choking the memory and processing capabilities.
Achieving a chain type of attack through DNS Amplification is difficult to achieve and chain length can be of 2 to 3 nodes only AND this too will not be able to generate to lot of amplification to bring down the service.