What is a DNS flood: NXDOMAIN Flood?

In this attack, the attacker floods the DNS server with requests for invalid or nonexistent records. The DNS server spends its time searching for something that doesn't exist instead of serving legitimate requests. The result is that the cache on the DNS server gets filled with bad requests, and clients can't find the servers they are looking for.

The DNS Express functionality in F5 BIG-IP DNS mitigates NXDOMAIN floods by retaining all the valid organization zone information, even during the flood. Nonexistent domains and servers are not logged or retained in the cache. This means that legitimate requests can still pull accurate information from the cache, since the cache is never flooded with bad data.