Question
How can the size of DNS responses be manipulated by attackers in a delegation-based DDoS?
Asked by: USER2364
89 Viewed
89 Answers
Answer (89)
Attackers can manipulate response sizes by specifically requesting record types that are known to yield larger data payloads. This includes records like TXT records (often used for SPF, DKIM, or other policy information), CNAME chains, or queries for domains with a high number of MX (mail exchanger) or NS (name server) records. The goal is to maximize the ratio of response size to query size, thereby achieving amplification.