Menu
Get startedLog in to the Management Console
System status+30 211 444 3269Under attack?
Aptranet
Contact salesSign up

DNS DDoS: why authority is the first target

A DNS flood takes the name off the internet before the CDN sees a request. Cloud DNS Anycast is built to stay reachable under volumetric attack.

Get startedSecurity

You cannot cache your way out of a nameserver flood. If authority is unreachable, the CDN, the origin and the status page that shares the same zone are all gone. Put the zone on DDoS-protected Anycast.

Small target, large blast radius

Authoritative DNS is a handful of names compared with HTTP. Attackers know that. Cloud DNS spreads authority across 210+ servers designed to absorb volumetric events.

Anycast is the absorber

Queries and junk go to a nearby available path instead of a single unicast pair. That is the same idea as a CDN, for packets that never become HTTP.

Do not share fate with the website origin

Registrar DNS sitting on a general-purpose VM next to the blog is a combined failure domain. Split authority onto Cloud DNS.

CDN plus DNS

HTTP floods hit Cloud CDN. DNS floods hit Cloud DNS. Use both when the hostname matters.

Continue on Aptranet

Related articles

Frequently Asked Questions

No. The CDN never sees requests that do not resolve. Host the zone on Cloud DNS.

You still follow expected DNS hygiene. The product is protected authoritative Anycast for your zones.

Contact emergency response. Call first if lookups are already failing.

Run this on Cloud DNS.

Get started with our Management Console in less than 2 minutes, or connect with an expert to supercharge your business today.

Connect with an expertGet started