An mDNS amplification attack is usually waved away as impossible, on the grounds that multicast DNS is a link-local protocol that cannot be reached from the internet. That holds only when a device refuses to answer unicast queries from off its own segment, and a DDoS test exists to find out which case you are actually in. Where a responder does answer strangers, it becomes an ordinary member of the amplification attack family: spoof the victim's address into a small query and the device sends a larger reply to someone who never asked.
What makes mDNS amplification specific
Multicast DNS, defined in RFC 6762, lets devices resolve names on a local network with no central server, the machinery behind Apple Bonjour and the Avahi daemon on Linux. It runs on UDP port 5353 and is designed to stay on the local link, answering the multicast group rather than crossing a router. The abuse turns on a single misconfiguration: a responder that treats a unicast query from any source as legitimate will reply across segment boundaries, and that reply carries service records larger than the probe.
Two facts keep this vector modest rather than headline-grabbing, and both are worth stating plainly. First, its amplification factor is small: US-CERT's advisory TA14-017A puts mDNS in the region of 2 to 10 times, nowhere near the hundreds that NTP or CHARGEN deliver. Second, its power comes from population, not per-host ratio. The reflectors are printers, smart-home gear, and Bonjour-speaking machines, deployed in enormous numbers and rarely audited for what they answer, so the vector scales by breadth of exposure rather than by a spectacular multiplier on any one device.
Why it matters under attack
The replies are well-formed mDNS from real devices doing exactly what their firmware intends, so there is nothing hostile to fingerprint and no bad sender to block. With a low factor the arithmetic favours the defender more than it does against a high-ratio reflector, but a large enough pool of off-segment responders still adds real volume to a multi-vector flood, and that volume has to be soaked up rather than filtered.
The corrective levers sit outside the victim's estate as usual: source-address validation (BCP 38) at the originating networks, and responders configured to ignore unicast queries from off-link. Neither is under the target's control.
What a DDoS test measures
The receiving-side test measures absorption, how much reflected mDNS the edge tier swallows before goodput slips, but the more useful question here points inward, because the fix genuinely is local. Does anything on your network answer UDP 5353 from off-segment, turning a printer into a public reflector. The same absorb-do-not-block reasoning applies to every open UDP service left facing the internet, which Understanding DDoS Attack Vectors works through vector by vector.