The DNS infrastructure is a target to countless attacks. And when we say countless, we mean it. Just in 2020, there were around 10 million (data from NETSCOUT Threat Intelligence Report)! So, we are all under constant DNS attacks.

The 3 most common DNS attack types that you can suffer are the following:

1. DNS spoofing attack

The DNS spoofing attack (also known as DNS poisoning) is a very common DNS attack type that involves modified DNS records that the bad actor inserts inside the cache memory of the DNS resolvers. The modified records usually lead to a different IP address than the original name records. The visitors get redirected to the domain of the bad actor. There they can share sensitive data that could later be used for different illegal activities – stealing money or identity.

Suggested article: 5 DNS Attacks Types that could affect you

It is often that the victims don’t even understand that there was a problem. They are redirected to a site that looks a lot like the one they wanted to visit.

It is really hard to stay protected from such an attack because people usually won’t double-check the IP address of a domain before using the site. We can use anti-virus software on our devices, don’t click shady links, and always check if something looks fishy on a site before using your bank card.

2. DDoS amplification attack

DDoS attacks can be used against DNS too. In this case, a typical DDoS attack uses vulnerabilities that the DNS has to create massive traffic of DNS queries that uses a method to get amplified even further. The huge traffic is directed towards the victim’s IP address. The victim can’t handle it, and eventually, the traffic completely overwhelms it. This could lead to a long downtime.

The amplification component usually comes from the fact that the queries ask for multiple DNS records, and that way, each query can get many times bigger results that will go towards the victim’s device.

What you can do to protect yourself is to use a DDoS protection service that can scan the traffic and identify the malicious traffic coming toward you. Or have a large network of name servers working with a load balancing method that can handle strong traffic.

3. DNS flood attack

DNS flood attack is another common type of DDoS attack. This one is different from the DDoS amplification attack. Here we don’t have the complex process of amplification. In this case, the bad actor usually creates a network of controlled devices (botnet) that he or she can use on-demand. The bad actor decides on target and uses the botnet to create strong traffic from multiple devices directed at the victim’s device. The goal is the same, to overwhelm the target. It is a really common attack that many servers suffer all the time.

The way to stay safe is the same, too – DNS load balancing and DDoS protection.

Conclusion

Last year there were around 10 million DNS attacks. In 2021 there will probably be a lot more. It is a never-ending story of defending our IT infrastructure. Don’t leave it without any protection. Use DNSSEC and add DNS protection from DDoS attacks too. Try to limit your downtime caused by there 3 most common DNS attack types. You can do it!