A Deep Dive Into DNS Packet Sizes: Why Smaller Packet Sizes Keep The Internet Safe

This post details Cloudflare's proactive measures to mitigate DDoS amplification attacks by optimizing DNS packet sizes. It highlights the use of ECDSA with 256-bit keys for DNSSEC signatures, resulting in significantly smaller response sizes compared to RSA implementations. Additionally, the post announces the deprecation of the ANY query type, which was often exploited for DDoS attacks, and explains the rationale and implementation of this change. The combined effect of these measures is to keep DNS answers within a 512-byte UDP packet limit, thereby preventing abuse.