Quantify malicious DNS query volume, how much your RPZ feeds block, resolver headroom and amplification exposure.
Malicious query volume is a simple share of total resolver traffic, and the part your threat feeds miss is what reaches the attacker's infrastructure. The amplification figure works the other way — it estimates how much reflected traffic an open or abused resolver can generate on behalf of a spoofed source. DNS is the one protocol almost every organisation allows outbound without inspection, which makes it the default channel for command and control, data exfiltration and reflection attacks.
DNS Security
malicious qps = query rate × malicious share; unblocked = malicious × (1 − feed coverage); reflected bits = spoofed qps × amplification × 512 bytes × 8.
malicious qps = query rate × malicious share; unblocked = malicious × (1 − feed coverage); reflected bits = spoofed qps × amplification × 512 bytes × 8. Malicious query volume is a simple share of total resolver traffic, and the part your threat feeds miss is what reaches the attacker's infrastructure. The amplification figure works the other way — it estimates how much reflected traffic an open or abused resolver can generate on behalf of a spoofed source.
DNS is the one protocol almost every organisation allows outbound without inspection, which makes it the default channel for command and control, data exfiltration and reflection attacks.
This calculator takes 6 inputs: Resolver query rate, Resolver rated capacity, Share of queries to malicious or suspicious domains, Malicious domains covered by your threat feeds, Cache hit ratio, Amplification factor of the abused record type. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Both. It reduces upstream load and exposure, but it also means most queries never reach an upstream resolver where you might inspect them — so your visibility has to sit on the recursive resolver itself. Cached answers for a domain that has since been added to a block list also keep resolving until the TTL expires.