QDCR: DNS–QUIC Cross-Protocol Traffic Amplification for Denial-of-Service Attacks

Abstract

Traditional Denial-of-Service (DoS) attacks typically target individual systems and rely on sustained traffic injection to cause disruption. In this work, we present a cross-protocol attack in IPv4/IPv6 networks that exploits three protocol mechanisms—QUIC Version Negotiation, DNS TXT records, and IP fragmentation—to create an exponential traffic amplification loop between DNS and QUIC services. Once the loop is established, an attacker only needs to inject a small amount of initial traffic to trigger large volumes of traffic between vulnerable servers, rapidly exhausting resources and potentially causing service failure. To evaluate the feasibility, scale, and impact of this attack, we conduct controlled experiments and Internet-wide measurements. In a high-bandwidth testbed, the attack sustains peak traffic of approximately 5.7 Gbps between targeted servers; under more realistic network conditions, it can completely suppress legitimate background traffic. Our Internet-wide scan identifies 7,890,041 QUIC services and 36,395 potentially exposed DNS services. We conclude by discussing practical mitigation strategies and outlining directions for strengthening protocol designs against such cross-protocol amplification attacks.