# Anycast DDoS protection for sites, APIs and DNS | Edgium > DDoS protection on an anycast network in Brazil and abroad: the attack is split across points and stops at the edge. For sites, stores, APIs, DNS and TCP and UDP services, with a hidden origin. Source: https://edgium.net/en/ddos-protection Leia esta página em português: https://edgium.net/protecao-ddos --- [Edgium](https://edgium.net/en/) / DDoS Protection # DDoS protection: the attack is split across the network and stops at the edge Every point on the Edgium network, in Brazil and abroad, announces the same IPs. A distributed attack arrives split across them, each point filters its share, and your server receives only real traffic. [Set up a trial](https://edgium.net/en/contact#formulario) See what gets protected ![Lime-green sphere inside a transparent barrier, with particles hitting it from outside, illustration of DDoS protection](https://edgium.net/assets/img/ddos.webp) ## Why an anycast network holds up under attack On a single server, the whole attack lands in one place. On an anycast network, routing takes each visitor, and each attacking machine, to the nearest point. The volume spreads out, and filtering happens before anything reaches you. ### The volume is split Each point receives only the share of the attack coming from its region, and filters it there. None of your servers receives the full volume. ### The origin stays hidden Your server's IP does not appear in DNS. Attackers find the Edgium network, and the origin can accept only Edgium and close itself off from the rest of the internet. ### A point goes down, traffic keeps flowing If a point goes offline, BGP sends traffic to the next one, which has the same IP. No DNS change and no waiting for TTL. ## What gets protected DDoS protection comes with every product, because they all run on the same network. You choose what to put behind the edge. ### Site, online store and API Through the [CDN and WAF](https://edgium.net/en/cdn): the web application firewall blocks SQL injection and other common attacks, blocks by country, IP, host and user-agent, and challenges bots and suspicious traffic before it reaches the application. ### Internet provider DNS Through [DNS Firewall](https://edgium.net/en/dns-firewall): random subdomain floods, mass NXDOMAIN, empty queries and ANY stop at the edge, with per-second limits tuned to your network. ### DNS zones In [managed DNS and DNS Slave](https://edgium.net/en/dns): the same protection as DNS Firewall, built into the zones that answer through the anycast network. ### Email, telephony and databases Through the [Load Balancer](https://edgium.net/en/load-balancer): SMTP, SIP, MySQL and SQL Server go through the edge over TCP and UDP, without exposing your servers' IPs. ## Where each type of attack stops | Attack | Where it stops | What happens | | --- | --- | --- | | Traffic flood | At the edge, split across points | Each point filters its share, and the origin does not receive the volume | | HTTP request flood | At the WAF | Challenge for bots and suspicious traffic, blocking by country, IP and user-agent | | SQL injection and web attacks | At the WAF | Rules against common web attacks, before they reach the application | | Random subdomain and NXDOMAIN | At DNS Firewall | Dedicated per-second limits, separate from normal traffic | | ANY query (amplification) | At DNS Firewall | Refused, so your DNS is no longer used against third parties | | SYN flood (TCP) | At the edge | Fake connections stop before they reach your server | | DNS hijacking and poisoning | At managed DNS | DNSSEC and blocking of hijacking and poisoning | | Direct attack on the server IP | It does not get through | The origin IP stays hidden, and it can accept only Edgium | ## What changes for your company and your visitors ### For your company - **Site up during the attack:** bad traffic stays at the edge and good traffic keeps flowing. - **A right-sized server:** the origin does not need to be sized for the worst day. - **Onboarding without migration:** your DNS stays where it is, and going back means undoing one record. - **People watching:** our team sets it up and watches the traffic with you, in Portuguese. ### For your visitors - **Pages that open,** even while someone is trying to take the site down. - **Nearby responses,** from the closest network point, in Brazil or abroad. - **No strange address:** the same domain and the same padlock as always. ## Use cases Common situations and how Edgium handles each one. ### Online stores and e-commerce Black Friday without slow pages: edge cache, WAF against bots and DDoS protection at the peak. [See the full example](https://edgium.net/en/use-cases#loja-virtual) ### Internet provider (ISP) and hosting DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge. [See the full example](https://edgium.net/en/use-cases#provedor) ### VoIP telephony and SIP exchanges A SIP exchange out of the line of fire: hidden IP, attack stopped at the edge and more than one server behind it. [See the full example](https://edgium.net/en/use-cases#telefonia) ## Questions about DDoS protection ### What is a DDoS attack? It is a distributed denial-of-service attack: many machines, from many places, send traffic or requests at the same time to take down a site, an API or a DNS server. ### How does an anycast network help against DDoS? Every Edgium point, in Brazil and abroad, announces the same IPs. The attack arrives split across them, each point filters its share, and none of your servers receives the full volume. ### Do I need to move my DNS to Edgium? No. Your DNS stays where it is. To protect a site, you only change its records to point to Edgium, including on the root domain, with plain A and AAAA records. ### Can I test the protection before signing up? Yes. Talk to us: Edgium sets up a trial with a subdomain, an application or a zone, and you follow it with your own traffic before moving the rest. ### I am already under attack. Can you help? Message us on WhatsApp and tell us the domain, service or IP being attacked. We work with you on the fastest way to put the service behind the edge. ## Talk to Edgium and test the protection Tell us what you need to protect and whether you have been attacked before. We set up a trial with a subdomain, an application or a zone, and follow it with you. [Set up a trial](https://edgium.net/en/contact#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20DDoS%20protection.)