Advanced DNS Protection: mitigating sophisticated DNS DDoS attacks

Cloudflare introduces Advanced DNS Protection for Magic Transit customers, a distributed, stateful mitigation system designed to stop sophisticated DNS-based DDoS attacks (e.g., randomized query floods and DNS laundering) that evade traditional fingerprinting. Leveraging flowtrackd, customer-specific historical models, counting Bloom filters for compact profiles, and configurable token-bucket tolerance, the system enables zero-second, per-edge detection and mitigation while sharing intelligence across the network. New “DNS Protection” analytics in Network Analytics, GraphQL, and Logpush provide visibility into passed/dropped queries and characteristics, helping customers tune defenses despite DSR constraints.