3 ms·

Why does the attacker need an open resolver, couldn't an authoritative DNS server be used as an attack amplifier too? Is the next logical step going to be war

• peskey 14y ago
  Authoritative DNS servers are used in attacks too, they are however a lot smaller scale. Querying one big zone across 10,000 recursive servers vs. querying the same big zone against 2 authoritative servers.
• agwa 14y ago
  Wow, that's a really good question. Thinking about this a bit, I don't think authoritative servers pose as big of a problem in practice. DNS amplification attacks require that the size of the response be much larger than the size of the query (which is why it's an "amplification" attack). Right now amplification attacks query for the same large response via lots of different open resolvers. However, I suspect the majority of authoritative servers out there only ever return small responses, which would limit the number of servers an attacker could use in an amplification attack. Furthermore, the attacker would need to tailor a specific query for each server rather than using the same query for all of them, making the attack more difficult to pull off.