A DNS amplification attack is a volumetric attack vector, one of the reflection classes a thorough DDoS test is built to exercise. It is a reflection attack that runs over DNS: the attacker sends small queries with the victim's address forged as the source, and the resolver answers the victim with a response many times larger than the request. The size gap between question and answer is the whole point, and DNS supplies a generous one.
Why DNS amplifies so well
DNS runs over UDP on port 53, and UDP performs no handshake, so a resolver cannot confirm that the source address on a query is genuine. It simply answers whoever the packet claims to be from. Forge the victim's IP and every reply lands on the victim instead of the sender. That is the shared reflection mechanism DNS has in common with NTP, CLDAP, and the rest of the family.
What is specific to DNS is how far the answer outweighs the question. A short query such as ANY asks a resolver to return every record it holds for a name, and EDNS0 lets that response grow to several kilobytes in a single UDP datagram. DNSSEC widens the gap further, because signed zones carry bulky RRSIG and DNSKEY records that ride along in the reply. The result is a published amplification factor commonly cited in the range of 28 to 54 times the request size. That is modest next to memcached's five-figure ratio, but DNS makes up for it with the sheer number and ubiquity of resolvers willing to answer.
The reflectors are open recursive resolvers: DNS servers that will resolve queries for anyone on the internet rather than only their own users. Historically there were millions of them, misconfigured home routers and forgotten servers among them, which gave attackers a vast and self-renewing pool of amplifiers to spray traffic through.
Why it matters under attack
DNS amplification is the canonical high-volume reflection vector, and it is what upstream scrubbing capacity is usually sized against. The traffic arriving at the victim is not obviously malicious: it is ordinary DNS responses from thousands of real, legitimate resolvers, so blocking by source reputation accomplishes little and the flood has to be absorbed rather than filtered by origin.
The scale is not theoretical. In March 2013 the attack on Spamhaus reached roughly 300 Gbps using DNS reflection through open resolvers, at the time one of the largest recorded DDoS events and the incident that put amplification on every network operator's radar. Later reflectors pushed the ceiling higher, but DNS remains a standard component of large multi-vector floods.
The structural fix sits with networks other than the target. Source-address validation (BCP 38) at the carrier level would stop the spoofed queries from ever leaving their origin network, and closing open resolvers removes the reflectors, but both depend on the wider internet acting rather than the victim. Authoritative operators can also deploy Response Rate Limiting to blunt their servers' usefulness as amplifiers. Because none of that is under the target's control, defense at the victim end is a question of absorption, not prevention.
What a DDoS test measures
For DNS amplification the control under test is everything upstream of the origin, not the application. A test drives a controlled volumetric load shaped like reflected DNS traffic and characterizes how much the edge or scrubbing center absorbs before clean traffic starts to degrade, and the latency mitigation adds when it cuts over.
The result is a pair of numbers that a datasheet never gives you: the absorption headroom (how much reflected volume the path swallows before goodput falls) and the time to mitigation (how long the flood reaches the origin before scrubbing engages). Testing focuses there because the reflectors are legitimate and the spoofing happens on networks you do not run, so there is nothing at the origin to harden away, only capacity and cutover speed to verify. The mechanics of each reflecting protocol are detailed in Understanding DDoS Attack Vectors.