Advanced DNS Protection
Cloudflare Advanced DNS Protection, powered by flowtrackd
, provides stateful protection against DNS-based DDoS attacks, specifically sophisticated and fully randomized DNS attacks such as random prefix attacks.
Cloudflare’s Advanced DNS Protection works by first learning your traffic patterns and forming a baseline of the type of DNS queries you normally receive. Later, the system will be able to distinguish between legitimate and malicious queries, protecting your DNS infrastructure without impacting legitimate traffic.
Currently, the protection system only analyzes DNS over UDP (it does not include DNS over TCP).
The Network Analytics dashboard will display system-specific analytics for Advanced DNS Protection in the DNS protection tab, including the queried domains and record types.
Advanced DNS Protection is currently available in beta to Magic Transit customers.
Protection for simpler DNS-based DDoS attacks is also included as part of the Network-layer DDoS Attack Protection managed ruleset.
- Contact your account team to enable Advanced DNS Protection and make the initial configuration. The initial thresholds are based on your network’s individual behavior.
- Log in to the Cloudflare dashboard and select your account.
- Go to L3/4 DDoS > Advanced Protection > General settings.
- Add the prefixes you wish to onboard. Advanced DNS Protection will only be applied to the prefixes you onboard. If you already onboarded the desired prefixes when you configured Advanced TCP Protection, you do not need to take any other action.
- Go to Advanced DNS Protection.
- Select Create Advanced DNS Protection rule.
- In Mode, select a mode for the rule.
- Under Set scope, select a scope to determine the range of packets that will be affected by the rule.
- Under Sensitivity, define the burst sensitivity, rate sensitivity, and profile sensitivity to determine when to initiate mitigation.
- Select Deploy.
If you cannot find any data related to Advanced DNS Protection in the DNS Protection tab of Network Analytics, it could be because one of these reasons:
- You did not add your prefixes to Advanced L3/4 DDoS Protection.
- Cloudflare did not enable the Advanced DNS Protection system yet.
- You do not have any DNS over UDP traffic.
Cloudflare collects DNS-related data such as query type (for example, A
record) and the queried domains. For details, refer to Data collection.
Advanced DNS Protection can protect you against volumetric DNS DDoS attacks. To perform DNS caching, proxying, and configuration, use the Cloudflare DNS Firewall.
Currently, Advanced DNS Protection is not available for DNS Firewall.