DNS Security Calculator
Quantify malicious DNS query volume, how much your RPZ feeds block, resolver headroom and amplification exposure.
About DNS Security Calculator
Malicious query volume is a simple share of total resolver traffic, and the part your threat feeds miss is what reaches the attacker's infrastructure. The amplification figure works the other way — it estimates how much reflected traffic an open or abused resolver can generate on behalf of a spoofed source. DNS is the one protocol almost every organisation allows outbound without inspection, which makes it the default channel for command and control, data exfiltration and reflection attacks.
Formula
DNS Security
malicious qps = query rate × malicious share; unblocked = malicious × (1 − feed coverage); reflected bits = spoofed qps × amplification × 512 bytes × 8.
- feed coverage
- Share of malicious domains present in your RPZ or threat feed
- amplification
- Response-to-query size ratio for the abused record type
Worked example
With the default values below, DNS Security Calculator returns Unblocked Malicious Queries per Day of 6,998,400. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Resolver query rateaccepts 1–100,000,000 qps
- 45,000 qps
- Resolver rated capacityaccepts 1–100,000,000 qps
- 120,000 qps
- Share of queries to malicious or suspicious domainsaccepts 0–100 %
- 1.2 %
- Malicious domains covered by your threat feedsaccepts 0–100 %
- 85 %
- Cache hit ratioaccepts 0–100 %
- 82 %
- Amplification factor of the abused record typeaccepts 1–200 ×
- 54 ×
Results
- Unblocked Malicious Queries per Day
- 6,998,400
- Malicious Query Rate
- 540.0 qps
- Blocked Malicious Queries per Day
- 39,657,600
- Resolver Utilisation
- 37.5%
- Upstream Query Rate After Cache
- 8,100.0 qps
- Amplified Reflection Output
- 0.1194 Gbps
Step by step
- 1Values used
- 2DNS Security
- 3Unblocked Malicious Queries per Day= 6,998,400
- 4Malicious Query Rate= 540.0 qps
- 5Blocked Malicious Queries per Day= 39,657,600
- 6Resolver Utilisation= 37.5
- 7Upstream Query Rate After Cache= 8,100.0 qps
- 8Amplified Reflection Output= 0.1194 Gbps
Assumptions and limits
- The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is DNS Security calculated?
malicious qps = query rate × malicious share; unblocked = malicious × (1 − feed coverage); reflected bits = spoofed qps × amplification × 512 bytes × 8. Malicious query volume is a simple share of total resolver traffic, and the part your threat feeds miss is what reaches the attacker's infrastructure. The amplification figure works the other way — it estimates how much reflected traffic an open or abused resolver can generate on behalf of a spoofed source.
Why does DNS Security matter?
DNS is the one protocol almost every organisation allows outbound without inspection, which makes it the default channel for command and control, data exfiltration and reflection attacks.
What values do I need to enter?
This calculator takes 6 inputs: Resolver query rate, Resolver rated capacity, Share of queries to malicious or suspicious domains, Malicious domains covered by your threat feeds, Cache hit ratio, Amplification factor of the abused record type. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does a high cache hit ratio help security or hurt it?
Both. It reduces upstream load and exposure, but it also means most queries never reach an upstream resolver where you might inspect them — so your visibility has to sit on the recursive resolver itself. Cached answers for a domain that has since been added to a block list also keep resolving until the TTL expires.