Humans type names; networks need numbers.
The Domain Name System translates hostnames like www.example.com into IP addresses. It runs primarily on UDP port 53 and is a frequent DDoS target and amplification vector.
6 min read
Your device asks a recursive resolver (often your ISP or 1.1.1.1). The resolver queries root, TLD and authoritative nameservers until it gets an answer.
Results are cached with TTL values to reduce load. Stale caches during attacks can prolong outages if TTLs are too high.
A / AAAA - IPv4 and IPv6 addresses. MX - mail servers. NS - authoritative nameservers. CNAME - alias to another name. TXT - verification and SPF.
Anycast DNS spreads queries across PoPs - useful for resilience but requires DDoS capacity at each edge.
DNS amplification sends small queries that trigger large responses from open resolvers, spoofing the victim's IP as source.
Mitigation: close open resolvers, rate-limit port 53, use DNSSEC-aware filters and anycast with sufficient scrubbing capacity.
UDP is fast for small queries. Large responses may fall back to TCP. Attackers abuse UDP because it is stateless.
DoH encrypts DNS inside HTTPS on port 443 - harder to inspect locally but improves privacy.
TMW Shield filters DNS floods and amplification with protocol-aware UDP profiles.