DNS Random subdomain

DNS random subdomain (A) flood

Random labels under a fixed zone force cache misses while still receiving valid A answers — distinct from NXDOMAIN pattern.

How it works

  1. Pattern: randomNN.example.com A queries where the name exists or wildcard resolves.
  2. Every query misses resolver cache even when answers succeed.
  3. Authoritative server still does lookup work per unique label.
  4. Compare with NXDOMAIN pattern to test negative vs. positive cache paths.

Packet flow (illustrative)

Query: rand48291.example.com A → valid answer (cache miss).

Illustrative flow — not a live capture.

Pattern Random label A
vs NXDOMAIN Valid answers
Engarde DNS target list

What to watch in Engarde

  • Authoritative QPS vs. resolver CPU.
  • Wildcard zone behavior under label explosion.
  • RRL triggering on authoritative side.

Running this simulation

DNS flood against zone you control with wildcard or pre-provisioned random labels; compare with cached fixed-name queries.

Mitigation perspective

Wildcard rate limits and per-client QPS on authoritative; monitor glue NS load.