What Is a DDoS Attack?
How It Works, Why It's Dangerous, and How DNS Helps Protect You
DDoS stands for Distributed Denial of Service. That sounds complicated, but the idea is actually very simple. Let's use a real-world example to understand it.
Imagine a small restaurant with 50 seats. On a normal day, real customers walk in, eat their food, pay, and leave. Everything works fine. Now imagine that someone sends 10,000 fake customers to flood the entrance all at once. They crowd the doorway, fill every seat, and block the hallway. Real customers who actually want to eat can't even get through the door. The restaurant hasn't been robbed or broken into — it's simply overwhelmed and can't serve anyone.
A DDoS attack does exactly the same thing to a website or an online service. Attackers flood a server with so much fake traffic that real users can't connect. The website becomes slow, shows error messages, or goes completely offline.
The word "Distributed" is important. It means the attack doesn't come from one computer — it comes from thousands or even millions of different devices at the same time. This makes it extremely hard to stop, because you can't just block one source. The fake traffic is coming from everywhere.
A DDoS attack follows a predictable pattern, and it starts long before the actual flood of traffic begins.
Step 1: Build a botnet. The attacker first needs an army of devices to launch the attack from. They do this by spreading malware — malicious software that secretly infects computers, security cameras, home routers, and other internet-connected devices. Each infected device becomes a "bot" or "zombie" that the attacker can control remotely. Together, these devices form a botnet — a network of thousands of compromised machines spread across the world. Most device owners have no idea their equipment has been recruited.
Step 2: Pick a target and attack. The attacker sends a single command to the entire botnet: "Send as many requests as you can to this target." All the infected devices obey simultaneously.
Step 3: The target gets overwhelmed. The server receives millions of requests per second. Its internet connection fills up, its processor maxes out, or its connection table overflows. It simply can't handle the volume.
Step 4: Real users are locked out. Anyone trying to visit the website gets timeouts, error pages, or no response at all. The service is effectively down — even though the server itself hasn't been compromised.
The devices most commonly recruited into botnets are IoT devices — security cameras, baby monitors, DVRs, smart light bulbs, and home routers. Why? Because they often ship with default passwords that owners never change, they rarely receive security updates, and they're connected to the internet 24/7. Your home security camera could be attacking a website right now without you knowing.
Not all DDoS attacks work the same way. They generally fall into three categories, each targeting a different part of the infrastructure.
| Type | Goal | Examples |
|---|---|---|
| Volumetric | Flood the network bandwidth | UDP flood, ICMP flood, DNS amplification |
| Protocol | Exhaust server resources | SYN flood, Ping of Death, fragmented packets |
| Application Layer | Overwhelm the application | HTTP flood, Slowloris, slow POST |
These attacks aim to use up all the target's internet bandwidth. One particularly clever technique is DNS amplification. Here's how it works: the attacker sends a tiny DNS query (maybe 60 bytes) to a public DNS server, but forges the return address to be the victim's IP. The DNS server dutifully sends its large response (sometimes 4,000+ bytes) to the victim. One small query produces a response 50 to 100 times larger — that's the "amplification." Multiply that by thousands of DNS servers and millions of queries, and you get a tidal wave of traffic hitting the victim.
This is exactly why blocking DNS ANY queries matters. ANY queries return the largest possible DNS responses, making them the perfect amplification tool. Blocking them reduces the amplification factor dramatically.
These target the networking layer of a server. The most famous example is the SYN flood. Normally, when your computer connects to a server, there's a three-step handshake: "I want to connect" → "OK, go ahead" → "Thanks, I'm connected." In a SYN flood, the attacker sends millions of "I want to connect" messages but never completes the handshake. The server allocates memory for each half-open connection, waiting for a reply that never comes, until it runs out of resources.
These are the sneakiest. Each individual request looks perfectly legitimate — it's just a normal page visit or API call. The problem is volume. Think of 10,000 people each ordering one item at a fast-food counter. Each order is completely normal, but the counter simply can't serve them all at once. These attacks are the hardest to defend against because it's difficult to distinguish real users from attackers.
DDoS attacks aren't hypothetical — they happen every day, and some have been massive.
In October 2016, the Mirai botnet attacked Dyn, a major DNS infrastructure provider. The botnet was made up almost entirely of IoT devices — cameras and DVRs with default passwords. When Dyn's DNS went down, so did Twitter, Netflix, Reddit, GitHub, Spotify, and dozens of other major websites. The websites themselves were fine — their DNS was unreachable, so nobody could find them. It was like erasing every restaurant from Google Maps: the restaurants still exist, but nobody can get directions.
By 2023, the largest recorded attacks exceeded 1 Tbps (terabit per second) — enough data to download about 125,000 movies every second.
The gaming industry is the number one DDoS target worldwide. Competitive gamers use DDoS attacks to knock opponents offline during matches, and disgruntled players attack game servers out of frustration. It's so common that "booting" someone offline is part of gaming culture.
DNS and DDoS are connected in three important ways. Understanding these connections helps explain why DNS infrastructure is both a target and a defense.
As explained above, open DNS resolvers can be abused as traffic amplifiers. An attacker sends small queries with a forged source address, and the DNS server sends large responses to the victim. This is why responsible DNS services block ANY queries by default and implement per-IP rate limiting — to prevent their infrastructure from being weaponized.
If the DNS infrastructure goes down, every website that depends on it becomes unreachable — even if the web servers are running perfectly. The 2016 Dyn attack proved this dramatically. This is why redundant, distributed DNS infrastructure matters. If your DNS has multiple servers in different locations, an attack on one location doesn't take everything down.
Here's the part most people don't think about: DNS filtering can actually prevent your devices from participating in DDoS attacks. Remember how botnets work — malware on your device connects to a command-and-control (C2) server to receive instructions. That connection starts with a DNS lookup. If your DNS blocks the C2 domain, the malware can't phone home, can't receive commands, and your device can't be used in the attack.
Our DNS infrastructure is built with DDoS resilience and botnet prevention in mind:
DNS filtering blocks the command-and-control domains that recruit your devices into attacks. Set up protection in under 5 minutes.
Get Started Free