A phantom domain attack is a Layer 7 attack vector against DNS resolvers, one of the application-layer classes a thorough DDoS test is built to exercise. The attacker stands up (or points at) authoritative name servers that respond very slowly or not at all, then floods a target recursive resolver with queries for domains those servers own. Each query forces the resolver to open outbound state and wait out its timeout on a phantom that never answers. With enough distinct queries in flight, the resolver's outstanding-query slots and memory fill, and legitimate lookups for real domains stall behind the dead ones.
Why it matters in DDoS testing
The damage lands on your recursive resolver even though the attacker never sends it a large volume of traffic: the cost is held query state and timeout budget, not bandwidth. A test characterizes how many concurrent unresolved queries the resolver tolerates before real resolution degrades, and whether hardening (shorter timeouts, per-server query caps, holding down repeat offenders) actually engages under load. DNS is a recurring single point of failure, which is why it earns dedicated coverage in understanding DDoS attack vectors.