什么是 DNS 洪泛攻击？
DNS 洪泛是分布式拒绝服务（DDoS）攻击的一种，通过向 DNS 服务器（权威名称服务器或递归解析器）发送海量 DNS 查询来压垮 DNS 基础设施。其目标是耗尽服务器资源，使 DNS 服务不可用，从而阻止合法用户解析域名。
DNS 洪泛攻击的影响
当 DNS 服务器不堪重负时：
Normal operation:
User → DNS query → DNS server → Response → Website loads
During DNS flood:
User → DNS query → DNS server (overwhelmed, no response)
→ Website doesn't load (even though web server is fine)
- 网站无法访问，即使 Web 服务器仍在正常运行
- 电子邮件投递失败（MX 记录查询失败）
- 依赖 DNS 的 API 和服务不可用
- 对共享 DNS 基础设施造成附带损害
DNS 洪泛攻击的类型
直接 DNS 查询洪泛
攻击者以高频率发送合法 DNS 查询：
Botnet → Millions of DNS queries → Target DNS server
Query examples:
example.com A
www.example.com A
random1.example.com A
random2.example.com A
...millions more...
- 查询本身合法，难以过滤
- 常针对随机子域名，以绕过缓存
- 使用僵尸网络实施分布式攻击
DNS 放大攻击
利用递归解析器放大攻击流量：
1. Attacker sends small query to open resolver
2. Spoofs source IP as victim's IP
3. Resolver sends large response to victim
4. Attacker amplifies bandwidth 28-54x
Attacker sends: 60-byte query for TXT record (ANY query)
Resolver sends: 3000-byte response to victim
Amplification: 50x
NXDOMAIN 洪泛
查询不存在的域名以绕过缓存：
Query: random-12345.example.com (doesn't exist)
Server must check authoritative zone every time
Cannot be cached (NXDOMAIN responses often have low TTL)
Consumes more server resources than cached responses
幽灵域名攻击
查询不会响应的合法域名：
Attacker: Queries resolver for slow/non-responsive domains
Resolver: Waits for timeout, consumes resources
Result: Resolver resource exhaustion
随机子域名攻击
查询随机子域名以避免命中缓存：
Query: abc123random.example.com
Query: xyz789random.example.com
Query: def456random.example.com
Each is unique → cache miss → authoritative query
Overwhelms authoritative nameservers
攻击向量与技术
僵尸网络驱动的攻击
Compromised devices:
- IoT devices (cameras, routers)
- Infected computers
- Hacked servers
Distributed attack:
10,000 bots × 100 queries/sec = 1 million queries/sec
反射攻击
Attacker spoofs victim's IP
Sends queries to many open resolvers
Resolvers respond to victim with large answers
Victim receives amplified traffic
应用层洪泛
Legitimate-looking queries
Difficult to distinguish from real traffic
May target specific resource-intensive query types
检测 DNS 洪泛攻击
异常查询量
Normal baseline: 10,000 queries/second
During attack: 500,000+ queries/second
# Check query rate (BIND)
rndc status | grep "queries resulted"
# Analyze query logs
tail -f /var/log/named/queries.log | wc -l
NXDOMAIN 比率过高
Normal: 5-10% NXDOMAIN responses
Attack: 50-90% NXDOMAIN responses (random subdomain flood)
源 IP 分布
Legitimate: Diverse source IPs, geographic spread
Attack: Concentrated sources, unusual geographic patterns
查询模式
Legitimate: Repetitive queries (common domains cached)
Attack: Unique queries (random strings, no cache benefit)
响应时间下降
Normal: < 50ms response time
Under attack: > 1000ms or timeouts
缓解 DNS 洪泛攻击
基础设施级防御
#### Anycast DNS
将流量分散到多个地理位置：
Single IP address (e.g., 1.2.3.4) announced from multiple locations
Attack traffic automatically routed to nearest server
Load distributed across global network
Harder to overwhelm all locations simultaneously
- 自动分配负载
- 地理冗余能力
- 吸收攻击流量
#### 扩充 DNS 基础设施
Capacity: 10x normal peak traffic
Reserves: Handle sudden spikes
Auto-scaling: Add capacity during attacks
#### 速率限制
# BIND rate limiting (response-rate limiting)
rate-limit {
responses-per-second 10;
window 5;
slip 2;
};
限制来自同一来源的响应，以防止放大攻击。
#### 查询过滤
# Block ANY queries (common in amplification)
# Block excessively long queries
# Block known-malicious patterns
# Block ANY queries
match-query {
type ANY;
action drop;
};
DNS 服务商级防御
#### DNSSEC
DNSSEC 不能直接阻止洪泛，但可以：
- 在攻击期间防止缓存投毒
- 在攻击条件下维护数据完整性
#### 隐藏主服务器配置
Master server (hidden): 10.0.0.1 (not publicly known)
Slave servers (public): ns1.example.com, ns2.example.com
Attackers target slaves
Master remains operational
Can quickly update slaves if needed
#### DNS 防火墙 / IDS
Analyze queries in real-time
Block suspicious patterns
Whitelist known-good clients
Blacklist attack sources
应用级保护
#### 响应速率限制（RRL）
Limit identical responses to same client
Prevents amplification attacks
Slip mode: Occasionally allow queries through (to not break legitimate recursive resolvers)
options {
rate-limit {
responses-per-second 5;
referrals-per-second 5;
nodata-per-second 5;
nxdomains-per-second 5;
errors-per-second 5;
window 5;
};
};
#### 缓存优化
Increase cache size to absorb repeated queries
Longer TTLs where appropriate (trade-off with agility)
Prefetch popular records
#### 查询过滤
# Drop queries for non-existent zones
# Block queries from known-bad sources
# Rate-limit per-source queries
网络级防御
#### BGP 黑洞
Route attack traffic to null0
Sacrifice availability to preserve infrastructure
Last resort when attack overwhelms capacity
#### 上游 ISP 过滤
Coordinate with ISP to filter attack traffic
Source IP validation (prevent spoofing)
Traffic scrubbing centers
#### DDoS 缓解服务
Cloudflare, Akamai, AWS Shield
Absorb attack traffic before reaching your servers
Global capacity to withstand large attacks
DNS 弹性的最佳实践
使用多个 DNS 服务商
Primary provider: Cloudflare
Secondary provider: AWS Route 53
If one is attacked/down, other continues serving
Different infrastructure reduces single point of failure
实施 DNSSEC
Protects against DNS spoofing/cache poisoning
Maintains integrity during attacks
Build trust even under attack conditions
监控 DNS 性能
Real-time query rates
Response times
NXDOMAIN percentages
Geographic distribution of queries
Error rates
定期进行容量测试
Load testing: Can infrastructure handle 10x traffic?
Failover testing: Do secondary providers activate correctly?
Attack simulation: Test mitigation strategies
禁用权威服务器上的递归
# BIND
recursion no;
权威名称服务器不应充当递归解析器。
限制区域传送
# BIND
allow-transfer { 10.0.0.2; 10.0.0.3; }; # Only specific slaves
防止攻击者导出整个区域。
保持软件更新
Regularly update DNS server software
Patch known vulnerabilities
Subscribe to security advisories
应对正在进行的 DNS 洪泛攻击
立即行动
1. 确认攻击正在发生
# Check query rate
rndc status
# Check load
top
2. 启用速率限制
# BIND: Enable RRL if not already active
rndc addzone rate-limit
3. 联系 DDoS 缓解服务商
- 启用清洗服务
- 将流量重定向到缓解网络
4. 分析攻击模式
# Top query types
grep "query" /var/log/named/queries.log | awk '{print $6}' | sort | uniq -c | sort -rn | head -20
# Top queried domains
grep "query" /var/log/named/queries.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
5. 屏蔽明显的攻击来源
# Identify top source IPs
grep "query" /var/log/named/queries.log | awk '{print $5}' | cut -d# -f1 | sort | uniq -c | sort -rn | head -50
# Block at firewall
iptables -A INPUT -s ATTACKER_IP -j DROP
中期行动
1. 扩展基础设施
- 增加名称服务器容量
- 如果尚未采用 Anycast，则通过 Anycast 分发
2. 实施额外过滤
- 屏蔽攻击特有的查询模式
- 将已知良好来源列入允许列表
3. 与服务商协调
- ISP / 托管服务商
- DNS 服务商
- DDoS 缓解服务商
4. 记录攻击
- 数据包捕获
- 日志
- 流量图表
- 用于事后分析和法律用途
攻击后分析
1. 复查缓解措施的效果
2. 识别基础设施弱点
3. 更新事件响应流程
4. 考虑长期改进措施（多服务商 DNS、更大容量）
法律与报告
向主管部门报告
- FBI IC3（美国）：ic3.gov
- 当地网络犯罪部门
- ISP 滥用部门
证据收集
# Packet captures
tcpdump -i eth0 -w dns-attack.pcap port 53
# Full query logs
tar -czf attack-logs-$(date +%Y%m%d).tar.gz /var/log/named/
# Traffic graphs/screenshots
# System resource usage
DNS 洪泛攻击会严重威胁在线服务，但通过适当的基础设施、监控和缓解策略，可以将其影响降至最低。