Future Of Websites Without DDoS

The talk opens with the weakness of a single-location endpoint. The Domain Name System is an old protocol that is hard to protect, and DNSSEC only covers part of the problem. When a site depends on one unicast address, its availability depends on the capacity behind that one point, so a flood can exhaust the link or the server until it stops responding.

The proposed countermeasure is anycast. Instead of one server, the same address is announced from many servers spread across the world using BGP routing, so each request reaches the nearest healthy point. Caching DNS resolvers at those locations keep latency low and spread traffic that would otherwise overwhelm one origin. The speaker also separates ordinary visitors from attack bots, crawlers and indexing bots, arguing that filtering has to happen before traffic reaches the origin server.

The speaker explains the motivation: the organisation behind the talk was hit by some of the largest bandwidth attacks seen in the Czech Republic in 2022 and concluded it needed its own infrastructure. The resulting network runs anycast DNS with DNSSEC support and a reverse proxy that applies rules so only valid traffic reaches the origin. Because only proxy addresses are published, the origin IP stays hidden, and the proxies can also balance IPv4 and IPv6 traffic. The takeaway is that a globally distributed, filtered edge can keep sites available, though the talk stayed high level and presented no measurements.