Improving DNS Server Resilience Against DDoS Attacks Through Anycast Routing

Domain Name System (DNS) is the critical backbone of the internet, translating human-readable domain names into machine-readable IP addresses. DDoS attacks are a type of distributed denial-of-service (DDoS) attacks where the attacker attempts to make a victim's resources unavailable by flooding the server with bots that have high bandwidth which results in a slow server or outright a server shutdown. Anycast routing is a crucial technology in internet services such as DNS servers. This research paper aims to test the features of anycast routing in DNS to evaluate its resilience against DDoS attacks. A quantitative and Black-box technique approach is used, using experiments that simulate DDoS attacks on DNS servers in various scenarios. Data was collected from nine popular web sites in Indonesia that use DNS servers with and without Anycast routing. The results showed that Anycast routing, especially with Cloudflare's WARP feature, improved DNS resilience against DDoS attacks by maintaining service availability with an average response time of 172.44 ms for before the attack and 117.66 ms after the DDoS attack. However, this experiment also found the need to use additional protections, such as WARP, to effectively manage and mitigate DDoS attacks. This research also emphasizes the importance of combining Anycast routing with additional protection to improve the resilience of DNS servers against external threats such as DDoS attacks.