How is amplification different from reflection?

Reflection is bouncing traffic off a third party so it arrives from them rather than from the attacker. Amplification is the third party's reply being larger than the request. Amplification attacks are reflection attacks that also multiply the volume.

Can I stop it by blocking port 53?

Not usefully. The traffic has already consumed your inbound bandwidth by the time you can drop it, and if you run anything DNS-related you need that port working.

Why do innocent servers participate?

They are not compromised — they are answering a query that appears to come from the victim. From the resolver's point of view it is doing exactly what it exists to do.

Is my server being used for this?

If you run a public DNS resolver with recursion enabled for everyone, or have memcached or NTP exposed, then likely yes. Those services should never accept requests from the open internet.

Learning centre

Attacks & threats

6 min readUpdated Jul 2026

What is a DNS amplification attack?

Quick answer

DNS amplification is a reflection attack: the attacker sends small DNS queries to public resolvers while forging the victim's address as the source, so every reply is delivered to the victim instead of back to the attacker. Because a DNS response can be dozens of times larger than the query that produced it, a modest connection can generate an enormous flood. The traffic arriving at the victim comes from legitimate servers that were simply answering a question they had no reason to doubt.

How reflection works

UDP does not verify who sent a packet. The attacker exploits that by putting the victim's address in the source field of a DNS query and sending it to a resolver that answers anyone. The resolver does its job and sends the answer to what it believes is the requester — the victim.

The attacker's own address never appears in the traffic the victim receives. From the victim's perspective, thousands of normal DNS servers around the world have all decided to send them large replies at once.

The path the traffic takes

  attacker                 open resolvers            victim
     │  small query,           │                       │
     │  forged source ────────▶│                       │
     │  (60 bytes)             │                       │
     │                         │ ── large reply ──────▶│
     │                         │    (3000+ bytes)      │

  1 Gbit/s of queries  ×  ~50 amplification  =  ~50 Gbit/s arriving

Why the factor matters so much

Amplification factor is the ratio between what the attacker sends and what the victim receives. A DNS ANY query against a zone with many records can produce a response fifty or more times the size of the request; some protocols are far worse.

Protocol	Typical amplification	Why it is exposed
DNS	28 – 54×	Open resolvers answering recursive queries for anyone
NTP (monlist)	up to 550×	A legacy command returning the last 600 clients
memcached	10,000×+	Instances exposed to the internet with UDP enabled
SSDP	30×	Consumer routers responding to discovery on the WAN side
CLDAP	50 – 70×	Misconfigured directory services reachable publicly

Defending as the victim

There is nothing you can configure on your own server to stop it — the traffic is already at your uplink, and it comes from thousands of legitimate resolvers. Defence has to happen upstream, on a network with more capacity than the attack.

Filtering upstream: reflection traffic is recognisable, since it is replies you never asked for
Enough capacity to absorb the flood while it is being discarded
An origin address the attacker cannot reach directly, so the filtered path is the only path
Never block by source address — those are innocent servers, and there are far too many

Not being part of someone else's attack

The other half of the problem is that these attacks depend on misconfigured servers. If you run infrastructure, a few checks keep you from being conscripted.

Do not run an open recursive resolver — restrict recursion to your own networks
Rate limit responses (DNS RRL) on authoritative servers
Never expose memcached, NTP monlist or CLDAP to the public internet
Implement source address validation (BCP 38) so forged packets cannot leave your network

Frequently asked questions

Last updated 24 July 2026