I'm still not really getting it. Which IP addresses are they referring to when they say "huge swaths of the internet"? Most IP addresses... most notably includ

I'm still not really getting it. Which IP addresses are they referring to when they say "huge swaths of the internet"? Most IP addresses... most notably including the victim's IP address. Scenario: Attacker sends 36 byte DNS query with a falsified sender address (that of his victim) to, say, Google's DNS servers. If the origin isn't verified through something like IPsec, Google won't be able to tell that the sender was forged. Google then sends 3000 bytes to the victim, thinking they're simply replying to a request, whereas they're really (unknowingly) facilitating a DNS amplification attack (so called because the attacker turns e.g. 2Gb/s of botnet traffic to DNS servers into 200Gb/s of DNS responses to the victim.) Your random residential ISP may limit their DNS service to customers only -- unless the victim also happens to be a customer of said ISP (the very rare case), the victim's IP address will be refused service, and not sent a response. While this blocks "legitimate" requests (without forged senders) as well unless you're actually on that ISPs network, in practice this is rarely a problem -- DHCP is probably advertising the DNS servers which will respond to you on whatever network you're on. Aside from preventing other ISPs from having their customers freeload off your ISP's DNS server, this also prevents the attack (at least with regards to DNS servers.) How do they differentiate between a legit query and a DDoS query? CloudFlare, being on the sending side of the equation, can track what DNS requests are going outbound even without IPsec, and drop inbound responses which can't be matched up against one of those requests. That sounds expensive however. I imagine they do something much cheaper, like simply drop all inbound DNS traffic except the approved list of DNS servers that are probably advertised over DHCP anyways. Again, this can block technically "legitimate" requests where someone really did want to intentionally use some other DNS server, but again, rarely a problem.