This thread is making me grateful I just do email. DDoS on MX is rare because amplification is harder. HTTP is where the grief lives.
Looking for dDoS mitigation that works on sub-$10 VPS
Has anyone priced Oracle Cloud's always-free ARM instances as the origin itself? 4 cores, 24GB RAM, 200GB block. Not just a proxy layer but the actual server. If it survives, problem solved.
Two problems. One: they terminate for "violation of AUP" with no appeal, and getting attacked qualifies in their eyes. Two: the free tier is capacity-limited, you can't always get ARM in your preferred region. I know three people who woke up to suspended accounts after an attack. Not the victim's fault, but Oracle doesn't care.
So the real answer is: there is no sub-$10 solution for 5Gbps volumetric. The thread title should be "Looking for DDoS mitigation that doesn't exist." You need either money or acceptance of downtime.
Sad but true aye? Ramen budget, ramen protection. I still reckon the chained free tiers are the closest you get, just know it's duct tape and hope.