Most providers just null-route the server/VPS when under DDoS. Telling people to "contact their upstream provider" is not a solution at all in most cases. Providers just don't want to continue providing service to you, they don't want to fight for you, they just null-route. They care about their network, not you.
In fact this null-route is usually automatic: once they detect more than (for example) 250Mbps. And of course the null route is not removed automatically, you have to open a ticket and wait till they want to connect your server again.
So, in my opinion, a useful answer would be:
Is it a DDoS attack? How many Mbps do you see in the traffic graphs
(if your provider gives you that information)? Can you access the
server? If so, please execute the following commands: [commands to see
active connections, tcpdump and stuff like that]
Depending on the answers to these questions:
Attack is above 100Mbps -> you can't filter it with iptables (unless you have a 1Gbps VPS, kinda weird). You need a DDoS protected
proxy (CloudFlare for example) or a hardware firewall. [Explain how a proxy works. Important features when looking for a proxy (allow any port, not only :80 for example), the importance of hiding the real IP behind the proxy (for example when sending emails)...]
Attack is less than port bandwidth -> you can try to filter packets. What kind of DDoS are you facing? SYN flood? Check
syn-cookies [add more tips and guidance depending on DDoS type]
This will not solve DDoS attacks, but would help people understand what's happening, why the attack works, what they can/can't do to stop or mitigate it...
Once they know what kind of attack they are suffering and how it works they can ask for more specific help: Questions like "how to stop DDoS attack" become "how to limit connections per /24 IP range" or "configure mail relay server"...