Maybe you already have something… Id like an appliance sitting in front of our multiple piblic severs to mitigate ddos attacks. Using significant hardware resources and rules, and connected with other appliances to kill the attacks on a global scale… Fighting the fire while. Seeing the whole landscape is important… Maybe even possible that some ddos attacks come from behind one of these appliances and you can send the command for that appliance to blackhole all request. Even better… Maybe you can somehow fix the open resolver problem by sitting in front