Bad news

Despite the positive outcome of the latest attacks, security experts warn against complacency.

"I don't know if a serious effort could take out the root server system," Bellovin says. "We've heard of some really large botnets...The steps that have been taken since 2002 have made the network considerably more robust and resilient in the face of this kind of attack. We don't know if it's robust or resilient enough yet."

A botnet attack like this one would be more significant if it damaged the DNS servers that run key domains such as .com or .net. That's because the root servers handle far fewer queries than the .com and .net servers.

"There's more impact at the next level down below the root," says Ken Silva, chief security officer for VeriSign, which operates two root servers as well as the registries for .com and .net. "The .com servers handle 450,000 queries per second. If they don't work, that's 450,000 queries per second that fail to connect."

Protecting against these kind of attacks is why VeriSign announced this week a three-year, US$100 million effort to upgrade and expand the servers and network infrastructure that support its .com, .net and root servers. Dubbed Project Titan, the initiative will increase the capacity of VeriSign's network infrastructure 10 times by 2010.

Project Titan will "make the entire infrastructure that we operate much more resilient to these attacks," Silva says. It is "without a doubt the largest upgrade to a DNS top-level domain that's ever happened."

Few companies, government agencies or universities that run the DNS root servers on a voluntary basis can afford the kind of investment that VeriSign is making with Project Titan.

Corporate network managers also need to stay ahead of the game by continuing to invest in distributed DNS servers of their own.

McPherson says few corporations could withstand the kind of attack aimed at the three root servers this week.

"This was a 2G to 3Gbps attack," he says. "That could take most enterprises offline pretty easily...Attacks like this are pretty easy to launch."

McPherson says Arbor Networks saw DNS amplification attacks as large as 22G to 25Gbps during 2006. "They were pretty ugly, and the scale of those attacks was pretty large," he says. "The root servers are pretty resilient but most enterprises are not."

--Senior Editor Ellen Messmer contributed to this report.