DNS Security Calculator
Quantify malicious DNS query volume, how much your RPZ feeds block, resolver headroom and amplification exposure.
Inputs
ANY and DNSSEC responses reach 50–70× the query size.
Unblocked Malicious Queries per Day
6,998,400
Malicious Query Rate
540.0qps
Blocked Malicious Queries per Day
39,657,600
Resolver Utilisation
37.5%
Upstream Query Rate After Cache
8,100.0qps
Amplified Reflection Output
0.1194Gbps
Step by step
Values used
Resolver query rate = 45,000 qps; Resolver rated capacity = 120,000 qps; Share of queries to malicious or suspicious domains = 1.20 %; Malicious domains covered by your threat feeds = 85 %; Cache hit ratio = 82 %; Amplification factor of the abused record type = 54 ×
DNS Security
malicious qps = query rate × malicious share; unblocked = malicious × (1 − feed coverage); reflected bits = spoofed qps × amplification × 512 bytes × 8.
Unblocked Malicious Queries per Day
= 6,998,400
Malicious Query Rate
= 540.0 qps
Blocked Malicious Queries per Day
= 39,657,600
Resolver Utilisation
= 37.5
Upstream Query Rate After Cache
= 8,100.0 qps
Amplified Reflection Output
= 0.1194 Gbps
How it works
Malicious query volume is a simple share of total resolver traffic, and the part your threat feeds miss is what reaches the attacker's infrastructure. The amplification figure works the other way — it estimates how much reflected traffic an open or abused resolver can generate on behalf of a spoofed source. DNS is the one protocol almost every organisation allows outbound without inspection, which makes it the default channel for command and control, data exfiltration and reflection attacks.
Formula
DNS Security
malicious qps = query rate × malicious share; unblocked = malicious × (1 − feed coverage); reflected bits = spoofed qps × amplification × 512 bytes × 8.
- feed coverage
- Share of malicious domains present in your RPZ or threat feed
- amplification
- Response-to-query size ratio for the abused record type
Frequently Asked Questions
How is DNS Security calculated?
malicious qps = query rate × malicious share; unblocked = malicious × (1 − feed coverage); reflected bits = spoofed qps × amplification × 512 bytes × 8. Malicious query volume is a simple share of total resolver traffic, and the part your threat feeds miss is what reaches the attacker's infrastructure. The amplification figure works the other way — it estimates how much reflected traffic an open or abused resolver can generate on behalf of a spoofed source.
Why does DNS Security matter?
DNS is the one protocol almost every organisation allows outbound without inspection, which makes it the default channel for command and control, data exfiltration and reflection attacks.
What values do I need to enter?
This calculator takes 6 inputs: Resolver query rate, Resolver rated capacity, Share of queries to malicious or suspicious domains, Malicious domains covered by your threat feeds, Cache hit ratio, Amplification factor of the abused record type. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does a high cache hit ratio help security or hurt it?
Both. It reduces upstream load and exposure, but it also means most queries never reach an upstream resolver where you might inspect them — so your visibility has to sit on the recursive resolver itself. Cached answers for a domain that has since been added to a block list also keep resolving until the TTL expires.