During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter offline in seconds. Now that this kind of attack is getting popular every day Im curious to know best practices to mitigate it. Has anyone had experience mitigating DNS Amplification DOS attack?
----- Edit Possible Workarounds -----
Ask provider to block incoming traffic with source port 53.
(Suggested by @rook) To have big guys like Cloudflare, Akmai or verisign to handle it for you which may cost but can be very effective when the provider is not able to help.
(Suggested by @user24077) To implement Remote Trigger Black Hole Routing/Filtering strategy which for my opinion can be effective but risky because you can end up wasting the complete bandwidth while trying to protect a node or client.