DNS DDoS and DNSSEC
Let’s say the root zone of the DNS contains the following records: am. 86400 IN NSEC americanexpress. NS DS RRSIG NSEC am. 86400 IN RRSIG NSEC 8 1 86400 2017 … Most DNS DDoS attacks go roughly as follows Generate unique names for a query (`ama`, `amb`…) The resolver can’t find it in its cache, and passes it upstream The authoritative server gets overloaded With DNSSEC, however the query for `ama` results in an immediate, local NXDOMAIN response, which includes the NSEC record and its associated signature. This NSEC response is telling us so much more than just the fact that the label ama is not a delegated label in the root zone. It’s telling us that all labels that lie between am and americanexpress are not defined in the root zone, and of course there are a very large set of such non-existent labels. However, for each such label, if it were to be queried, the NXDOMAIN response would include exactly the same NSEC records. (°) — http...