DNS DDoS and DNSSEC

Let’s say the root zone of the DNS contains the following records:

 am. 86400 IN NSEC americanexpress. NS DS RRSIG NSEC
 am. 86400 IN RRSIG NSEC 8 1 86400 2017 …

Most DNS DDoS attacks go roughly as follows

• Generate unique names for a query (`ama`, `amb`…) 
• The resolver can’t find it in its cache, and passes it upstream
• The authoritative server gets overloaded

With DNSSEC, however the query for `ama` results in an immediate, local NXDOMAIN response, which includes the NSEC record and its associated signature. 

This NSEC response is telling us so much more than just the fact that the label ama is not a delegated label in the root zone. It’s telling us that all labels that lie between am and americanexpress are not defined in the root zone, and of course there are a very large set of such non-existent labels. However, for each such label, if it were to be queried, the NXDOMAIN response would include exactly the same NSEC records. (°) — http://www.potaroo.net/ispcol/2017-11/1dns.html

In short, we now have a way of caching the non-existence of names too, and the DDoS only affects the immediate DNSSEC-enabled resolver, and that’s it!

Nifty!

(°) The DNSSEC response uses a zone “range”, providing the name before and the name after the queried name, using either lexicographic ordering (NSEC) or ordering of the hash of the names (NSEC3).