Forwarders Fuel DNS Attacks: The Invisible Risk

With open resolvers plummeting from 25M to 1.4M since 2014, attackers now exploit transparent DNS forwarders to sustain reflection volumes.

The core thesis is clear: these invisible components bypass traditional shielding by forwarding queries without rewriting source addresses, effectively turning protected anycast infrastructure into unwitting amplifiers. While DigiCert research notes that responsible disclosure removed over 250k devices, the sheer persistence of this architecture keeps the attack surface viable. Unlike standard resolvers, these forwarders do not handle responses, allowing them to scale attack impact while evading rate limiting and firewall rules designed for direct traffic.

Readers will learn how these forwarders expose shielded recursive resolvers, the mechanics of bypassing security perimeters via anycast infrastructure, and strategic mitigation steps for network operators. Data shows these devices remain stagnant in number while other open DNS components decline, with heavy deployment concentration in Brazil and India. As Maynard Koch's analysis confirms, ignoring this "invisible" layer leaves critical infrastructure exposed to high-volume spoofing that traditional defenses simply cannot.

The Role of Transparent DNS Forwarders in Modern Attack Vectors

Transparent DNS Forwarders and Packet Relaying Mechanics

Transparent DNS forwarders transfer queries without rebuilding packets, preserving the original spoofed source IP address data. These components act as invisible conduits that relay DNS requests while maintaining the attacker's forged identity in the packet header. By failing to normalize the source address, the forwarding device allows the upstream recursive resolver to perceive the query as originating directly from the victim. This specific behavior enables IP spoofing at scale because the responder sends large answers to the innocent third-party rather than the actual requester. Attackers exploit this mechanical oversight to bypass firewall rules designed to shield recursive infrastructure. The consequence is a distributed reflective amplification vector where the forwarder handles minimal load while the victim absorbs the return traffic. Google resolvers appear on 64.25% of these misconfigured devices based on research fingerprints. Cloudflare infrastructure accounts for another 9.09% of the observed upstream targets. This concentration means a small set of public resolvers inadvertently fuels the majority of these attacks. Operators must recognize that standard rate limiting often fails here because the forwarder does not see the amplified response. The architectural flaw lies in the lack of stateful tracking during the relay process. Disabling packet relaying or enforcing strict egress filtering remains the only definitive mitigation strategy.

Anycast infrastructure allows attackers to bypass rate limiting and scale reflective DDoS volume data. This mechanism exploits how transparent forwarders relay queries without rewriting source IP headers, effectively masking the attacker's origin while directing responses to a spoofed victim. Amplification factors between 40x and 60x are achievable using EDNS0 and DNSSEC signatures. A single 1 Gb connection can thus generate 40 Gb of downstream traffic, overwhelming target networks instantly. The critical flaw lies in the forwarder's failure to rebuild packets, leaving the original resolver exposed to massive return traffic it never requested. However, mitigation faces geographic concentration challenges. Data shows 31% of these devices reside in Brazil and 24% in India, creating distinct jurisdictional hurdles for remediation. 76% of identified forwarders apply upstream resolvers from substantial providers like Google or Cloudflare, inadvertently weaponizing legitimate anycast networks. Network operators must recognize that shielding resolvers alone is insufficient when the forwarding layer remains permeable. The architectural tension exists between maintaining transparent lookup performance and enforcing strict packet normalization at the edge. Until vendors patch this behavior, the attack surface remains expansive despite broader declines in open DNS devices.

Bypassing Firewall Rules to Expose Shielded Recursive Resolvers

data shows transparent forwarders bypass firewall rules, exposing previously shielded recursive resolvers to the global attack surface. This mechanism functions because the forwarder relays packets without rebuilding headers, causing upstream filters to trust the spoofed source IP as valid traffic. Shielded DNS resolvers, traditionally protected by strict access control lists, suddenly become reachable open targets for reflection. Between 25,000 and 30,000 such shielded entities are now accessible via this vector.

Operators frequently assume network perimeter defenses block direct queries to internal recursion, yet this architecture renders that assumption false. The limitation is that patching individual resolvers fails because the vulnerability exists in the forwarding path, not the resolution logic itself. Consequently, mitigation requires filtering at the edge router level rather than relying on recursive server configurations alone.

Mechanics: according to Stateless Packet Relaying in Transparent Forwarders

ResearchGate, transparent forwarders relay DNS requests without rebuilding packets, preserving the spoofed source IP address exactly as received. This stateless mechanism bypasses standard packet normalization checks found in recursive counterparts, allowing forged queries to penetrate upstream filters unchanged. Unlike recursive forwarders that must process large response payloads, these devices minimize internal state by assuming every incoming query is legitimate traffic. As reported by Accessing Shielded Infrastructure and Attack Scalability, this architectural choice allows attack volumes reaching 320 Mb on constrained hardware links. The fundamental flaw enables IP spoofing at scale because the upstream resolver perceives the query origin as the victim rather than the actual attacker.

However, this efficiency creates a severe security tension where performance optimization directly undermines boundary defense integrity. Operators often deploy these forwarders to reduce latency for local clients, yet the same configuration inadvertently exposes shielded resolvers to global exploitation. The inability to distinguish legitimate local traffic from external reflection attempts means firewall rules protecting backend infrastructure become ineffective.

Attackers use global anycast infrastructure to direct small queries toward powerful, distributed resolvers, generating massive response traffic toward victims. This distribution allows malicious actors to bypass local rate limiting by shifting the computational burden to upstream providers who honor the spoofed source IP embedded in the relayed packet. The mechanism relies on the forwarder relaying the initial query without processing the return path, creating an asymmetry where the backend resolver handles the heavy lifting of DNS reflective amplification.

However, the reliance on specific vendor hardware introduces variability; fingerprinting identifies MikroTik devices as a dominant subset, yet diverse equipment remains vulnerable across the environment. The operational implication for network defenders is that blocking individual IP ranges proves futile against such geographically dispersed anycast endpoints.

Per Global Distribution and Deployment, transparent forwarders exist in 175 economies, creating a fragmented defense perimeter. This geographic spread complicates incident response because operators cannot rely on single-jurisdiction remediation. A significant concentration remains in specific regions, skewing the risk profile for global routing tables. Dependence on major public resolvers introduces a systemic single point of failure. When forwarders direct traffic to these centralized anycast endpoints, local outages cascade globally.

Detecting these forwarders requires monitoring for source IP preservation anomalies rather than standard recursion tests. Operators must analyze return path consistency to identify stateless relaying behavior. The reliance on anycast infrastructure means blocking one node often fails to stop the flood. Traffic simply shifts to the nearest available resolver instance. The cost of inaction is measurable exposure to amplified volume.

Strategic Mitigation Strategies for Network Operators

Transparent DNS Forwarder Mechanics and Spoofing Vulnerabilities

Preserving spoofed source IPs allows transparent forwarders to relay DNS packets without rebuilding headers. ResearchGate data confirms this stateless mechanism bypasses packet normalization, letting forged queries penetrate shielded resolvers unchanged. Recursive counterparts process large responses, yet these devices minimize internal state by assuming every query is legitimate traffic. This architectural choice creates a severe vulnerability where IP spoofing scales effortlessly across the network edge. Open DNS device counts dropped from 25 million in 2014 to 1.4 million in 2026, but transparent forwarder volumes remain static despite remediation efforts. Fingerprinting via ZGrab and SNMP scanner tools identified only 2.

based on Configuring Rate Limiting and Ingress Filtering on Network Borders

RIPE Labs, operators must implement reverse path forwarding checks to stop spoofed packets at the network edge. This mechanism validates that incoming traffic originates from a reachable IP address, effectively blocking the forged source addresses required for reflection attacks. Border routers blindly forward malicious queries to upstream resolvers without this check. Strict filtering can drop legitimate traffic during asymmetric routing events if not tuned correctly. Operators gain a hardened perimeter but risk connectivity loss if failover paths are ignored. Thresholds should target query velocity rather than total bandwidth to preserve service availability during spikes. A practical configuration sets hard caps on queries per second for any single endpoint.

Evaluating the Risks of Unpatched Customer-Premises Equipment

Fingerprinting Unpatched CPE and Network Video Recorders

Researchers identified 13,072 devices using ZGrab and SNMP scanner tools across the global internet. This technical discovery relies on banner grabbing to expose default configurations that allow unmodified packet forwarding. The mechanism bypasses standard authentication by trusting any received query as legitimate traffic from a local client. Fingerprinting only succeeds against devices responding to specific probes, leaving many silent forwarders undetected in the wild. Unpatched hardware acts as an involuntary participant in large-scale reflection events.

The majority of these compromised units are MikroTik routers, though the inventory includes HikVision recorders spanning numerous autonomous systems. Misusing transparent forwarders allows attackers to bypass rate limits applied directly to recursive resolvers.

• Increased bandwidth billing due to outbound attack traffic.
• Reputation damage when ISP IP ranges appear in abuse reports.
• Resource diversion for emergency patching campaigns.
• Potential legal liability for negligence in device management.

Factory-default settings create a persistent vulnerability that software updates alone cannot fix if administrative access remains weak. The entire network edge stays exposed to hijacking attempts without strict ingress filtering. Geographic clustering enables adversaries to target a minimal set of network operators to maximize amplification efficiency. Attackers exploit this density to bypass complex global routing tables, focusing instead on specific autonomous systems with lax ingress filtering policies. Such concentration reduces the logistical burden of constructing massive reflection vectors. Regional density creates a single point of failure for mitigation efforts targeting those specific corridors. Operators facing unwilling participation in these attacks must weigh the convenience of default configurations against the liability of hosting attack traffic.

Disabling the feature stops local devices from reflecting spoofed queries outward. Rate limiting upstream traffic prevents saturated links during active assault phases. Implementing strict egress filtering blocks forged source addresses at the perimeter. Coordinating with regional ISPs ensures consistent policy enforcement across borders. Breaking legacy applications that depend on implicit DNS redirection without explicit configuration presents a hidden cost. Network engineers must decide if the operational simplicity of transparent forwarding justifies the risk of becoming a reflex node. The geographic skew means a few national regulators could dismantle a large percentage of the current attack surface.

AI-Enhanced Discovery and Geopolitical Fragmentation Risks

Threat actors will use artificial intelligence in 2026 to automate finding misconfigured forwarders. This acceleration transforms static vulnerability windows into fleeting targets for automated exploitation. Geopolitical fragmentation causes uneven security standard adoption across the internet. Regions with weaker regulatory enforcement face higher exposure rates due to delayed patching cycles on customer-premises equipment. Machine learning models scan IP ranges quicker than human operators can apply firmware updates. Disabling transparent forwarding entirely may break legacy applications dependent on implicit DNS resolution paths. Immediate security gains must be weighed against potential service disruption for outdated internal tools.

Inaction carries specific hidden costs:

• Accelerated discovery outpaces manual mitigation efforts by orders of magnitude.
• Regional fragmentation creates safe havens for unpatched infrastructure exploitation.
• Automated tools reduce the skill floor for launching large-scale reflection events.
• Legacy system dependencies complicate rapid remediation timelines.
• Cross-border policy inconsistencies allow threats to persist in regulatory gaps.

InterLIR recommends that network operators prioritize rate limiting on edge routers where disabling features is not immediately feasible. Maintaining smooth connectivity for older systems conflicts with securing the perimeter against rapid, AI-driven scanning. Adversaries exploit regional lag in security posture when this asymmetry remains unaddressed.