You could require proof of work, by requiring that every submissions are attached with a Proof of work, a string that when appended to the original URL, yields a string that when hashed, had a specified number of binary zeros. The number of zeros requested could be configured based on your system load.
This works to reduce a (D)DOS attack from polluting the database with spammy URLs. It doesn't protect against volumetric DDOS attack, which will still bring your service down. To protect against volumetric aspect of the DDOS, you'll need to replicate your servers. You need a server on many parts of the world which will check that the URL submission is valid (the proof of work is valid), before submitting the request to central database.
Additionally, you might also want to check that the expanded URL exists and is accessible before accepting submission, although there are reasons why URL that might not be resolvable to you could still be useful to other people (e.g. links to internal services, non-HTTP URLs).