Re:CoreDNS: DNS service discovery for the cloud
by hueving on Wednesday October 19, 2016 @11:53PM
(#12749635)
No it's not. You're fundamentally misunderstanding amplification attacks if you think RRL brings down the amplification factor.
The amplification factor is the ratio of the response size to a single packet. Not the number of packets you can send to a server.
The only thing the RRL helps with is forcing the attacker to spread packets over more DNS servers, but, as I pointed out, a good amplification attack already does this because it makes it harder for the victim to block DNS servers by IP.
The attacker isn't going to run out of DNS servers because there are hundreds of thousands authoritative ones, let alone open resolvers.
The amplification factor is the ratio of the response size to a single packet. Not the number of packets you can send to a server.
The only thing the RRL helps with is forcing the attacker to spread packets over more DNS servers, but, as I pointed out, a good amplification attack already does this because it makes it harder for the victim to block DNS servers by IP.
The attacker isn't going to run out of DNS servers because there are hundreds of thousands authoritative ones, let alone open resolvers.