Virtual private cloud services where you host the DNS server may also include DDoS protection.
One must distinguish between application layer attacks HTTP/S and UDP, cloud vendors won’t protect you implicitly for network layer attacks unless you purchased such service from them.
Far cry from needing $1e6 HW ourselves.