Unlike almost every control a DDoS test exercises, BCP 38 does not protect the network that deploys it; it protects everyone else. Published as RFC 2827 in May 2000, it is an ingress-filtering standard that directs network operators to drop packets whose source IP could not legitimately originate from the interface they arrive on, so a host cannot forge an arbitrary source address. Universal deployment would eliminate the IP spoofing that every reflection and amplification attack depends on.
Where the filter has to sit
BCP 38 works only near the sender. At the edge facing a single-homed customer, the set of valid source addresses is short and known: the prefixes assigned to that customer. The filter is a few lines of access list, and every packet carrying any other source is dropped before it reaches the wider internet.
One hop further in, that certainty disappears. A transit link carries traffic from thousands of networks, and the set of addresses that could legitimately arrive on it is close to the whole routing table. So the standard is written for the access edge: the broadband provider, the hosting company, the data-centre network that hands addresses to its customers.
Multihoming makes even the edge harder. A customer connected to two providers may legitimately send traffic sourced from one provider's prefix out through the other. RFC 3704, published in 2004 as BCP 84, extends the guidance to these cases, and its automated form, uRPF, checks the source against the routing table instead of a hand-written list.
What it does not stop
The filter's granularity is the customer prefix, not the host. A machine inside a /16 can still forge any of the 65,536 addresses in it. That is not enough to aim a reflected flood at an outside victim, but it is plenty to defeat a per-address rate limit or reputation list on the receiving side.
It also does nothing about attacks that never needed a forged source. A botnet flooding a web application from real, compromised hosts, or any attack that has to complete a TCP handshake, is untouched by source filtering, because the addresses are genuine.
And the incentive runs the wrong way. The operator pays the effort of deploying it and the benefit goes to strangers, which is the reason it is still incomplete more than two decades on, and why industry efforts such as MANRS list anti-spoofing as a commitment network operators sign up to rather than a default. The large public clouds are a partial exception: they validate the source address of traffic leaving a virtual machine by default, so a botnet of rented cloud instances cannot spoof the way one on an unfiltered hosting network can.
What a DDoS test measures
A test cannot confirm that other networks filter, and on its own origin BCP 38 has nothing to defend. What it can do is take the consequences seriously in two places.
On the receiving side, a test plan assumes forged sources exist and checks which controls quietly depend on source addresses being real: per-IP thresholds, allowlists, geographic rules. The reflection attack vectors that spoofing makes possible are exercised directly, often by generating the reflected traffic shape rather than forging requests, because the test's own sending networks usually enforce source validation too.
On the sending side, a quick check from inside the network shows whether its own edge would let a forged packet out, and that is the one piece of BCP 38 the organisation being tested actually controls.
The reflection and amplification family it was written to starve is covered in understanding DDoS attack vectors.