Authoritative DNS under DDoS

At 15:40 your public site becomes unreachable for a large fraction of users worldwide, while a smaller fraction load it fine. Dashboards: your origin and CDN edges are healthy and lightly loaded, almost no traffic is arriving at all. Synthetic checks from several regions fail at the DNS-resolution step ('SERVFAIL'). Your authoritative DNS is hosted by a single managed DNS provider, and that provider's status page reports it is mitigating a large DDoS against its anycast network. Recent context: none on your side; no deploy. How do you triage and mitigate?