All DDoS Definitions
DDoS Definition

Phantom Domain Attack

A phantom domain attack is a Layer 7 attack vector against DNS resolvers, one of the application-layer classes a thorough DDoS test is built to exercise. The attacker stands up (or points at) authoritative name servers that respond very slowly or not at all, then floods a target recursive resolver with queries for domains those servers own. Each query forces the resolver to open outbound state and wait out its timeout on a phantom that never answers. With enough distinct queries in flight, the resolver's outstanding-query slots and memory fill, and legitimate lookups for real domains stall behind the dead ones.

Phantom domain: queries to name servers that never answer Attacker floods the resolver with x8f3.phantom.tld q1z9.phantom.tld m4p7.phantom.tld unique, dead domains unique dead-domain queries Recursive resolver outstanding-query slots slot held: WAITING slot held: WAITING slot held: WAITING slots exhausted real lookups stall query upstream no reply, times out Phantom authoritative name servers never answer (or stall on purpose) A test measures how many unresolved queries the resolver tolerates before real DNS resolution degrades. BlackNeuron
A phantom domain attack floods a recursive resolver with queries for domains whose authoritative servers never answer, filling the resolver's outstanding-query slots so real lookups stall.

Why it matters in DDoS testing

The damage lands on your recursive resolver even though the attacker never sends it a large volume of traffic: the cost is held query state and timeout budget, not bandwidth. A test characterizes how many concurrent unresolved queries the resolver tolerates before real resolution degrades, and whether hardening (shorter timeouts, per-server query caps, holding down repeat offenders) actually engages under load. DNS is a recurring single point of failure, which is why it earns dedicated coverage in understanding DDoS attack vectors.