Last updated: October 2026
Every hosting provider claims DDoS protection. Almost none of them will tell you what actually happens to your server the moment an attack crosses their comfort threshold. That gap is where buyers of a DDoS protected dedicated server in Europe get burned: the marketing says "protected," the reality is a null route that takes the very IP you paid for and drops it into a black hole for hours. This guide gives you the one question that separates real mitigation from a slide deck, then shows what always-on protection looks like in practice.
The one question: what happens to my IP at attack +1 Gbps?
Ask any provider a single, specific question before you buy: "When a volumetric attack hits my server, what happens to my IP address?" The answer sorts the market cleanly into two camps.
The cheap camp answers with a shrug and a term of art: "null-routing" or "blackholing." What that means in plain language is that when your IP attracts an attack larger than they want to absorb, they stop announcing your IP to the internet entirely. The flood stops reaching their network because your server effectively ceases to exist. The attacker wins by definition, your site is down, and it often stays down for a fixed penalty window measured in hours regardless of whether the attack is still running. You are not protected. You are the sacrifice that protects everyone else on the shared uplink.
The real camp answers differently: "Nothing happens to your IP. Traffic is inspected and scrubbed, the bad packets are dropped upstream, and the clean traffic continues to your server on the same address." That is the answer you are paying for. If a provider cannot say it in those words, assume they null-route.
Why null-routing is still so common in Europe
Null-routing survives because it is free and it works — for the provider. Scrubbing traffic at line rate costs money: it needs capacity to absorb the flood, hardware or a network fabric to inspect it, and the routing intelligence to keep clean packets flowing. A budget host would rather write "DDoS protection included" and blackhole your IP at the first sign of trouble than build any of that. The phrase is technically true and practically worthless.
This is why the null-route test matters more than any number on a spec sheet. A 10 Gbps port means nothing if the provider's policy is to stop announcing your IP at 2 Gbps of inbound attack. Capacity without a scrubbing policy is just a bigger pipe to a blackhole.
What always-on L3/L4 scrubbing actually does
Genuine protection operates continuously, not as a switch someone flips after your monitoring already paged you. "Always-on" means every packet is inspected before it reaches your server, so mitigation is already in effect when an attack begins — there is no detection delay, no manual trigger, no window where your IP is exposed. On a DDoS-protected dedicated server from X-Zone Servers, scrubbing runs at the network and transport layers, where volumetric attacks arrive:
- Layer 3 (network): volumetric floods — UDP amplification, ICMP, reflection attacks — that try to saturate your uplink. These are absorbed and dropped in the network fabric, upstream of your hardware.
- Layer 4 (transport): SYN floods, ACK floods and connection-exhaustion attacks that aim to overwhelm the TCP stack rather than the pipe.
Layers 3 and 4 are filtered on every plan as standard, not sold back to you as a premium add-on. Layer 7 is different: network scrubbing does not filter HTTP floods, so run rate limits, a reverse proxy or a WAF on the server itself.
The capacity behind the promise
Scrubbing is only credible if the network underneath it can carry the load and route around trouble. X-Zone Servers puts 1 Tbps of always-on L3/L4 DDoS protection in front of every dedicated port, from 1 Gbps up to 200 Gbps (details on our network page). Volumetric floods are absorbed and dropped upstream of your server, so your IP stays announced while the attack fits inside that capacity.
Ask us for the mitigation threshold, and what happens to your IP above it, before you order: it is the same question this guide tells you to put to every provider.
Choosing a DDoS-protected dedicated server in Europe
The workloads most exposed to DDoS are rarely brochureware. They are the things attackers have a reason to hit: game backends, streaming and RTMP workloads, competitive multiplayer, VoIP, and anything where a few minutes of downtime costs real money or real players. For these, protection has to be the default state of the network, not a reaction.
Dedicated bare metal gives these workloads the isolation and raw performance they need with no noisy neighbors on the box. X-Zone's dedicated range starts at EUR 209/mo for a Dual Xeon E5-2630 with 16 cores/32 threads, 128 GB DDR4 and six SSD slots on a 1 Gbps port, and scales up to a Dual EPYC 9754 with 256 cores/512 threads, 1 TB DDR5 and 24× NVMe. Every configuration ships with the same 1 Tbps always-on DDoS protection (L3/L4). Xeon servers in stock are typically online within about an hour; EPYC builds take up to 14 days. Order in Austria, Bulgaria, France, Germany, Ireland, Italy, the Netherlands, Poland, Romania, Spain or the United States to keep round-trips short for your players and viewers.
If you are self-hosting game servers and want to start smaller, the same 1 Tbps L3/L4 protection applies to X-Zone's KVM VPS range with full root access — a practical game server DDoS protection entry point before you commit to bare metal.
How to run the null-route test on any shortlist
Before you sign anything, put every provider on your shortlist through the same three checks:
- The IP question: "At attack +1 Gbps, does my IP stay announced?" A real answer describes scrubbing. A vague answer, or the words "null route" and "blackhole," is a fail.
- Layer coverage: which layers does the network filter, and what does it leave to you? Ours filters L3/L4; L7 is yours to handle with rate limits or a WAF.
- Capacity vs. policy: ask both the port speed and the blackhole threshold. A big port with a low blackhole trigger is theater.
Verdict
The DDoS market runs on a comfortable ambiguity: "protection included" usually means "we will blackhole your IP to protect ourselves." The null-route test cuts straight through it — ask what happens to your IP at attack +1 Gbps, and buy only from the provider who answers "nothing." X-Zone Servers ships every server with 1 Tbps always-on DDoS protection (L3/L4), guaranteed ports up to 200 Gbps, and dedicated bare metal from EUR 209/mo in 11 countries; ask us where our own threshold sits. For workloads that get attacked, that is the difference between staying online and becoming the sacrifice.