My site is currently offline from this attack. I am considering that providers like DNSimple simply cannot provide the networking availability to mitigate these kinds of attacks. This is because the solution to these kinds of attacks, often, is that you need a larger pipe than the attackers. Very few people are good at both <some service> and having a huge pipe. For web apps, you can use CloudFlare, which does have a bigger pipe and is designed to mitigate this. But DNS is not a web app, so you can't just put DNSimple behind CloudFlare.

Hence, I'm going to try CloudFlare (assuming they take over DNS hosting, I need to check) and Google Cloud DNS, because then all parts of my site (from DNS to CSS hosting) will be with providers with bigger pipes than attackers can create. Hopefully that will prevent this kind of attack from taking my site down.

Yes, CloudFlare has a full-featured DNS offering, even if you don't use their proxying services.

Which has had a lot of problems this past week:

https://news.ycombinator.com/item?id=8665367

CloudFlare != CloudFront

My apologies, cloudfront had issues, cloudflare did not.

You can use two or more DNS providers, but if you do try not to list more than two name servers from any one provider when you delegate. You should also take care to do the same in your own zones "NS" record set. Some providers don't let you change the NS record set, so avoid those providers.

The reason for this is that resolvers will generally try at least three different name servers before giving up, so if you have three or more from a single provider that may not help.

There is also a big caveat to consider: once you use two more providers, whenever you need to make rapid DNS changes for your own availability reasons you will need to wait for the slowest-to-update provider.

have multiple providers? VPSs aren't expensive and setting up bind9 or bind10 or whatever authoritative name serving daemon isn't rocket science (well, you CAN do it wrong).

my experience shows, that at least 3 servers with 3 different providers is good enough. and "providers" I mean different company, city, datacenter, transit provider...

trusting single entity with anything (even if they say that they have many servers blabla... geologically blabla...)... well, you have situation like this right now :)

My god no. Don't even waste your time with VPSs and BIND.

* Get accounts with AWS (Route 53), dnsmadeeasy, and cloudflare.

* Monitor resolution at all of their name servers

* Either proactively spread your authoritative nameservers across providers, or update your root NS records based on your monitoring.