In order to mitigate reflection-amplification attacks, DNSCrypt seems to enforce queries that have a larger response than the query to be retransmitted over TCP. This feature will mitigate amplification attacks.

However, are the DNSCrypt resolvers still prone to flooding attacks with spoofed IP addresses? As I checked the DNSCrypt-proxy tool, obtaining and verifying certificates, in the beginning, is not necessary. A client can just make an encrypted query (using the resolver's public key) and send it to the resolver, and the resolver replies. So, an attacker can just generate different queries with different session keys and use spoofed IP addresses to DoS the resolver!

Consequently, expend the resolver's resources by forcing it to traverse the DNS hierarchy to find the answer, encrypt it and send it back to the client.

1 Answer 1


Any public service on the Internet can be flooded.

But the whole point of DNS amplification attacks is that traditional DNS servers and caches can be used to DoS other services.

By sending a tiny query, a much larger packet is sent to the victim. This asymmetry is why DNS amplification can be so useful to conduct attacks. It's cheaper for attackers than for victims.

By requiring queries to be at least as large as responses, there's no advantage in using DNS servers any more to conduct these attacks.

Spoofed packets can be directly sent to the victim; this is easier and way more efficient. Or to a regular DNS server, to take advantage of amplification.

By the way, the entire DNS hierarchy is rarely traversed, as responses are always cached.

  • Thank you for your response. But my point here is that if a DNSCrypt recursive resolver is the target of a flooding attack (with spoofed DNSCypt queries), the recursive resolver will allocate its computation resources to find the response and encrypt it, and then send it back to the source of the query. This DoS at the application layer is feasible because there is no necessary handshake at the beginning of the communication.
    – Ali Ss
    Commented Jan 31, 2023 at 3:14
  • 1
    @AliSs This separate "overload the resolver" attack is technically possible with or without spoofing, no? The comparison to reflection attacks and overall focus on spoofing in the question seems like a bit of a red herring, other than for instance a wide array of spoofed source addresses making identification difficult? Commented Feb 1, 2023 at 12:56
  • @HåkanLindqvist Overloading the resolver's computation resources (not just bandwidth). I agree that mentioning reflection attacks was misleading for overloading resolvers. Thus, my question was if it is possible to send lots of forged queries (with spoofed IP addresses) to a resolver and force it to answer all of them without the need for a handshake in the beginning. Just having the resolver's public key is enough to mount this attack. And for your last question, yes, spoofed addresses can bypass identification, and rate-limiting based on source IP addresses.
    – Ali Ss
    Commented Feb 1, 2023 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .