How can DNS flood attack be differentiated from UDPmix flood attack?

A DNS flood attack is (or can be, you can do DNS over TCP as well) a more specific type of UDP flood attack, where DNS is used to generate large DNS answers to spoofed DNS queries. Other protocols like NTP and SNMP are popular other types of UDP based flood attacks. All UDP attacks use some higher level protocol to generate the actual data for the attack. As with most DDoS attack types, the weakest link in the chain goes first. Often, this would be bandwidth, but if a server would have enough bandwidth it's very well possible that the server which is under attack would be overloaded another way (CPU, memory, logs filling up disks, etc).