A method of detecting a DDOS attack is disclosed. The method includes obtaining, at an authoritative DNS server, a plurality of DNS query packets from a plurality of DNS requestors over a communications network; analyzing, by an electronic processor, a set of the plurality of DNS query packets; determining, by an electronic processor, that a subset of the plurality of DNS query packets of the set meets a predetermined threshold for a rate of DNS queries; filtering the plurality of DNS query packets based on the determining to produce a filtered number of DNS query packets; and providing, by the authoritative DNS server, a DNS response for the plurality of DNS query packets that were filtered.