There's no ultimate solution, but there are a few things being done in common DNS servers that can mitigate the issue: * Large answers like ANY queries or larg

There's no ultimate solution, but there are a few things being done in common DNS servers that can mitigate the issue: * Large answers like ANY queries or large DNSSEC records should either be not supported or only supported via TCP (see RFC 8482 e.g. for ANY). * DNS software can implement response rate limiting: https://kb.isc.org/docs/aa-00994 https://kb.isc.org/docs/aa-00994 This doesn't prevent all amplification, but it prevents strong amplification, i.e. you'll be less valuable for attackers.