Over the past few weeks I have heard discussions about a DNS reflection attack and a DNS amplification attack.

Is there truly a difference between the two or are people just using 2 different names for the same attack method?

DNS Amplification Attack definition 1

A DNS Amplification Attack is a reflection-based Distributed Denial of Service (DDoS) attack. The attacker spoofs look-up requests to domain name system (DNS) servers to hide the source of the exploit and direct the response to the target.

DNS Amplification Attack definition 2:

A DNS Amplification Attack is a Distributed Denial of Service (DDoS) tactic that belongs to the class of reflection attacks -- attacks in which an attacker delivers traffic to the victim of their attack by reflecting it off of a third party so that the origin of the attack is concealed from the victim.

If you google "DNS Reflection Attack" what is resolved is a list of DNS amplification attacks.

US-CERT only notes of DNS Amplification Attacks.

Both definitions denote that the amplification attack is a class or part of a reflection attack.

What is the difference between just a DNS reflection attack and a DNS amplification attack?

  • Your second definition explains the difference quite succinctly. It is possible to reflect without amplification. Amplification is simply large volume of reflections.
    – schroeder
    Commented Jul 13, 2015 at 18:54

1 Answer 1


Full disclosure, I work for a company that develops DDoS mitigation and web application firewall services

DNS amplification is a Distributed Denial of Service (DDoS) attack in which the attacker exploits vulnerabilities in domain name system (DNS) servers to turn initially small queries into much larger payloads, which are used to bring down the victim’s servers.

DNS amplification is a type of reflection attack which manipulates publically-accessible domain name systems, making them flood a target with large quantities of UDP packets. Using various amplification techniques, perpetrators can “inflate” the size of these UDP packets, making the attack so potent as to bring down even the most robust Internet infrastructure.

DNS amplification, like other amplification attacks, is a type of reflection attack. In this case, the reflection is achieved by eliciting a response from a DNS resolvers to a spoofed IP address.

During a DNS amplification attack, the perpetrator sends out a DNS query with a forged IP address (the victim’s) to an open DNS resolver, prompting it to reply back to that address with a DNS response. With numerous fake queries being sent out, and with several DNS resolvers replying back simultaneously, the victim’s network can easily be overwhelmed by the sheer number of DNS responses.

To amplify a DNS attack, each DNS request can be sent using the EDNS0 DNS protocol extension, which allows for large DNS messages, or using the cryptographic feature of the DNS security extension (DNSSEC) to increase message size. Spoofed queries of the type “ANY,” which returns all known information about a DNS zone in a single request, can also be used.

Through these and other methods, a DNS request message of some 60 bytes can be configured to elicit a response message of over 4000 bytes to the target server – resulting in a 70:1 amplification factor. This markedly increases the volume of traffic the targeted server receives, and accelerates the rate at which the server’s resources will be depleted.

Moreover, DNS amplification attacks generally relay DNS requests through one or more botnets – drastically increasing the volume of traffic directed at the targeted server or servers, and making it much harder to trace the attacker’s identity.

My company provides various solutions to protect yourself against DNS attacks. Please read more about how you can mitigate these sort of attacks: https://www.incapsula.com/ddos/attack-glossary/dns-amplification.html


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .