Home / News I have a News Tip

Internet Root Servers Hit with Unusual DNS Amplification Attack

On Nov. 30 and Dec. 1, several of the Internet Domain Name System's root name servers received high rate of suspicious queries, reaching as high as 5 million queries per second, according to a report released by the Root Server System Advisory Council. The incident has been categorized as a unique type of DNS amplification attack.

"While it's common for the root name servers to see anomalous traffic, including high query loads for varying periods of time, this event was large, noticeable via external monitoring systems, and fairly unique in nature, so this report is offered in the interests of transparency."

The attack saturated network connections near some DNS root name server instances, however the system is said to have functioned as "designed, demonstrating overall robustness in the face of large-scale traffic floods observed at numerous DNS root name servers."

The organization has advised use of Source Address Validation and BCP-38 wherever possible to reduce the ability to abuse networks to transmit spoofed source packets.

Update Dec. 12: A new story reports that some security experts believe the attack was even more severe than originally thought. They say "it was brought about by a so-called 'zombie army' botnet unwittingly installed on hundreds of millions of smartphones through an as yet unidentified app."

Update Dec. 15: Verisign's Perspective on Recent Root Server Attacks

Follow CircleID on
Related topics: Cyberattack, Cybersecurity, DNS, Networks

If you are pressed for time ...

... this is for you. More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Vinton Cerf, Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Share your comments

Proposal: Require BCP38 for anybody connecting to root servers Bill Stewart  –  Dec 09, 2015 10:05 PM PST

Ok, you can't really do that, since people can still connect to the root servers through other networks, and Anycast means the root servers are spread around widely, but we can still wish.

To post comments, please login or create an account.




Sponsored byWhoisXML API


Sponsored byThreat Intelligence Platform

New TLDs

Sponsored byAfilias

Brand Protection

Sponsored byAppDetex

DNS Security

Sponsored byAfilias


Sponsored byVerisign

IP Addressing

Sponsored byAvenue4 LLC

Domain Names

Sponsored byVerisign