Definition
DNS amplification is a type of distributed denial of service DDoS attack that exploits the Domain Name System DNS to overwhelm a target with traffic. Attackers send small DNS queries to open DNS resolvers with a spoofed source IP address that belongs to the victim. These resolvers then send much larger DNS responses to the victim's IP address, creating a flood of data that can cripple the target system or network. Understanding this attack is crucial for network administrators to implement defenses and maintain service availability. For instance, an attacker might use a botnet to send thousands of DNS requests to public DNS servers, all pointing to a single victim's IP. This differs from a simple DNS flood which directly bombards the target with requests without the amplification factor. DNS amplification is a key concept tested on CompTIA Security+ and CISSP exams.