4 ms·
I just searched for this and this documentation entry came up: https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/configuring-ro
by SushiHippie 2y ago
I just searched for this and this documentation entry came up:
https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/configuring-route53-for-cost-protection-from-nxdomain-attacks.html https://docs.aws.amazon.com/whitepapers/latest/aws-best-prac...
I can't believe that their 'fix' is to set a wildcard dns entry, this feels somewhat like a joke.
Does this mean that a NXDOMAIN response costs more than a successful response?
- aeyes 2y agoIt has the same cost as a successful response which can quickly add up to a few hundred dollars per month with a couple of DNS enumeration scans. Google Cloud and Azure also bill DNS like this. Unless you need some of the advanced features you really shouldn't host your DNS in the big cloud providers.
- technion 2y agoCloudflare don't bill like this, part of why I moved off route 53.
- withinboredom 2y agoNeither does Digital Ocean, for that matter.
- beeeeerp 2y agoThat’s not entirely true - aliases to AWS resources are free (their suggested “workaround”).