Dyn DDoS Response: When a Third Party's Outage Takes Down Half the Internet
The October 2016 DDoS attack on Dyn — one of the internet's major DNS providers — knocked Twitter, Netflix, Reddit, GitHub, Spotify, and hundreds of other sites offline for most of a day. Dyn's incident response restored services in waves over 11 hours.
Background
Dyn provided authoritative DNS services for many of the internet's most visited websites. DNS is the internet's phone book — when Dyn's servers went offline, domains that used Dyn's nameservers became unreachable. The Mirai botnet (600,000 IoT devices) targeted Dyn with 1.2 Tbps of traffic.
The Attack
The attack began at 7:00 AM EST on October 21, 2016. Three waves of DDoS traffic overwhelmed Dyn's infrastructure at different times throughout the day. Dyn's engineering teams worked to mitigate each wave: scrubbing traffic, blocking malicious IP ranges, and routing traffic to unaffected infrastructure. The challenge was the scale and geographic distribution of the attack — Mirai's 600,000 devices were distributed across 164 countries, making IP-based blocking impractical.
Response
Dyn restored services partially after 2 hours for the first wave. The second and third waves required additional mitigation cycles. Full service restoration took approximately 11 hours. Dyn published a detailed incident report. Oracle subsequently acquired Dyn and integrated it into cloud services with redundant infrastructure.
Outcome
The Dyn attack was the largest DDoS ever recorded at the time. It demonstrated that a single DNS provider's outage could cascade to hundreds of major internet services. The incident drove adoption of multi-provider DNS strategies and DDoS mitigation scrubbing centre services.
Key Takeaways
- Critical services must use multiple DNS providers simultaneously so a single provider's outage does not cause complete unavailability
- DDoS mitigation requires geographic distribution of scrubbing capacity — single-region mitigation is insufficient for global attacks
- Incident communication during infrastructure outages must provide regular public updates to manage downstream service operators
- Third-party DNS, CDN, and cloud provider outages create cascading failures — map your single points of dependency