You cannot cache your way out of a nameserver flood. If authority is unreachable, the CDN, the origin and the status page that shares the same zone are all gone. Put the zone on DDoS-protected Anycast.

Small target, large blast radius

Authoritative DNS is a handful of names compared with HTTP. Attackers know that. Cloud DNS spreads authority across 210+ servers designed to absorb volumetric events.

Anycast is the absorber

Queries and junk go to a nearby available path instead of a single unicast pair. That is the same idea as a CDN, for packets that never become HTTP.

Do not share fate with the website origin

Registrar DNS sitting on a general-purpose VM next to the blog is a combined failure domain. Split authority onto Cloud DNS.

CDN plus DNS

HTTP floods hit Cloud CDN. DNS floods hit Cloud DNS. Use both when the hostname matters.