Security · 2h ago
Why ISPs Block DNS 'ANY' Queries to Prevent DDoS Attacks
ISPs block 'ANY' DNS queries to prevent DNS amplification DDoS attacks, where a small 50-byte request can trigger a 1000+ byte response. Attackers spoof a victim's IP to flood them with traffic. Google and Cloudflare allow such queries because they have infrastructure to filter spoofed traffic and use TCP fallback.
Meridian48 take
The article explains a common ISP practice but overstates the fix for recon work, as public resolvers may also rate-limit or block ANY queries.
dns-amplificationisp-blocking