A method and apparatus for defending against a DNS attack includes receiving a DNS request from a request source and obtaining an IP address of the request source, calculating a characteristic value of the IP address, and searching an internal memory for preset identifier information corresponding to the characteristic value. Based on the preset identifier information corresponding to the characteristic value being a detection identifier indicating an uncertainty of an existence of an attack risk in the DNS request, the method includes obtaining request record information and an unblocking time corresponding to the characteristic value, the request record information including a number of request times from the request source in a predetermined period. Based on the number of request times exceeding a preset request threshold, determining that the DNS request is an attack request and discarding the DNS request.