Considering their core products, DNS might be an early-warning sign of DDoS. A sudden surge in requests for a domain will trip a circuit breaker before the HTTP sessions begin. There's probably a way to tell the difference between a bot attack and a hug-of-death by the pattern of DNS.