> How would a TLS-using protocol be used as a DDoS amplification vector? Turning off UDP DNS would break everything that still uses it but adding the DNSSEC re

> How would a TLS-using protocol be used as a DDoS amplification vector? Turning off UDP DNS would break everything that still uses it but adding the DNSSEC records makes the UDP responses a DDoS amplification vector even if some clients use TLS. > You can return resolver errors or no data, there is plenty of options for DNS blackholing. DNSSEC validates NODATA responses and clients can respond to resolver errors in various ways that amount to more timeouts. > You'll need a PKI for that anyway so you can deploy DNSSEC root keys. That's assuming you want to MitM the connection rather than merely log the attempt before dropping it or record it for traffic analysis even if you can't MitM it.