DNS amplification: a small lie, a large flood

The idea

A DNS amplification attack makes a careless open resolver do the flooding: UDP never checks the sender, so a tiny forged query brings a large signed answer down onto a victim who never asked — until the resolver is shut to outsiders.

Steps

1. A resolver that answers everyone

   A resolver should answer only its own network. Ask this one the same name from inside the home network and from a stranger out on the internet, and see whether both are served. That second answer is the whole problem.

   legitClient:~# dig +short www.lab @10.0.1.10
   attacker:~# dig +short www.lab @10.0.1.10

2. A small question, a big answer

   Now the second ingredient. Ask for everything about the signed domain lab (an ANY query, DNSSEC data included). The question is a few dozen bytes; weigh the answer, stuffed with keys and records, against it.

   attacker:~# dig +notcp +dnssec ANY lab @10.0.1.10