How a DNS Dictionary Attack Cost Me $10K on Route 53

I got pulled in urgently by the FinOps team: the company's DNS cost curve had been climbing exponentially for a few days. Red alert, clear mission — find the culprit and stop the bleeding as fast as possible.

I dropped everything and started with standard network troubleshooting: checked whether query logging was enabled on the hosted zones, looked at total record volume, and ran resolution tests from multiple vantage points. At first glance, nothing abnormal in the public zones' resolution. It was only when I dug into the CloudWatch logs through Logs Insights that I realized the hole went a lot deeper.

The diagnosis: a DNS Dictionary attack

The infrastructure was the target of a massive, distributed DNS Dictionary attack (also called Water Torture or a random-subdomain attack). Someone quite determined to map our subdomains and exposed assets in our public zone was firing millions of queries per minute — random, nonexistent names like a1b2c3d4.mydomain.com. Route 53's authoritative servers dutifully answered with NXDOMAIN.

The catch is that, from AWS's billing perspective, a query that returns NXDOMAIN is still a valid, processed query — which means it's billed normally.

The irony of resilience: Route 53 absorbed the entire hit without a single latency blip, no degradation, no downtime. From an availability standpoint, the service proved itself a fortress. If FinOps hadn't flagged the financial anomaly, the application would have felt absolutely nothing.

Investigating with CloudWatch Logs Insights

To confirm the attack theory and isolate the traffic pattern, I ran two routine queries:

fields @timestamp, responseCode, queryName
| filter responseCode = 'NXDOMAIN'
| stats count(*) as total_queries by queryName
| sort total_queries desc
| limit 20

fields @timestamp, queryName, clientIp
| stats count(*) as query_count by bin(5m)
| sort @timestamp desc

The architectural fix: the wildcard + ALIAS trick

With the faucet wide open, the priority was to stop the billing without breaking resolution for the legitimate subdomains already in the zone. Digging deep into Route 53's billing model, I found an elegant way out: a query that matches a record using an ALIAS mapping to an eligible AWS resource — CloudFront, an Application Load Balancer, an S3 bucket in the same account — isn't billed.

1. 01We created a wildcard record (*.mydomain.com) in the hosted zone.
2. 02We pointed that wildcard via ALIAS to an internal resource under our control that answers neutrally — no query cost.
3. 03We validated the behavior in a test environment with the TAM and the AWS solutions architect before rolling it out to production.

With that in place, Route 53's resolution flow changes:

I aligned the architecture with the TAM and the AWS solutions architect, we validated it in test, and rolled it out to production after management sign-off. Within a few hours, the volume of billable requests collapsed and the Route 53 bill went straight back to baseline.

Lessons learned

• 01

  Route 53's resilience is absurd

  It absorbed 30 billion requests without blinking — a fortress for availability, but one that needs cost governance running alongside it.

• 02

  FinOps and engineering move together

  Financial visibility is also a security and infrastructure observability metric.

• 03

  Dedicated DNS observability is essential

  After the incident, I stood up a dashboard tracking NXDOMAIN volume with anomaly-detection alarms, so I'm never blindsided at the end of the month again.

• 04

  Knowing the architecture cold saves real money

  Understanding the fine print of AWS's documentation and billing rules is what saved the company's bill.

The psychological side of a crisis

In the day-to-day of leadership and engineering, it's easy to panic when you're staring at a five-figure charge piling up by the hour. In moments like that, I like to think of a scene from Lost where Dr. Jack Shephard explains how he deals with fear: he gives himself a short, counted window to feel it — and the next second, he turns his focus back to solving the problem.

A financial or operational crisis calls for calm, method, and the ability to analyze. Letting yourself feel the jolt for a few seconds, breathing, and turning back to the solution is what separates panicked reaction from high-impact decision-making.

For those who want to go deeper

• AWS Route 53 Pricing — official page, with the billing model for queries and ALIAS records.
• CloudWatch Logs Insights — official documentation for the query syntax used in the investigation.