The 35 year old identified only as S.K. was arrested in Barcelona and the house where he was staying searched by Spanish police, said a statement.
"He is suspected of involvement in the attack and so the prosecution service asked for his arrest," spokesman Wim de Bruin told AFP on Saturday.
Last month's attack targeted Spamhaus, a Geneva-based volunteer group that publishes spam blacklists used by networks to filter out unwanted email, and led to cyberspace congestion.
Spamhaus blamed the attack on Dutch web-hosting service Cyberbunker.
A source close to the investigation said that suspect S.K. was Sven Olaf Kamphuis, who acted as a spokesman for Cyberbunker at the time of the attack.
Kamphuis describes himself on his Facebook page as Minister of Telecommunications and Foreign Affairs for the Cyberbunker Republic.
De Bruin declined to speculate on whether further arrests would be made.
Computers, storage devices and mobile phones were seized during the Barcelona raid.
"S.K. is suspected of an unprecedented attack on non-profit organisation Spamhaus," the statement said.
"So-called DDoS attacks were last month also carried out on Spamhaus partners in the US, the Netherlands and the UK," it said.
Distributed denial of service attacks (DDoS) essentially bombard sites with traffic in order to disrupt.
Last month's attack was described as the most powerful ever seen and slowed web traffic.
S.K. is expected to be handed over to the Dutch authorities soon, the prosecution service said.
The attacks began, according to Spamhaus, after it placed Cyberbunker, a web hosting firm that "offers anonymous hosting of anything except child porn and anything related to terrorism", on its blacklist.
Cyberbunker said it had been unfairly labelled as a haven for cybercrime and spam.
"Spamhaus have pissed off a whole lot of people over the past few years by blackmailing ISPs and carriers into disconnecting clients without court orders or legal process whatsoever," Kamphuis was quoted as saying at the time.
Spamhaus, which also has offices in London, essentially patrols the Internet to root out spammers and provides updated lists of likely perpetrators to network operators around the world.
Experts said the attacks flooded Spamhaus servers with 300 billion bits per second (300 gigabytes) of data.
Prior DDoS attacks have been measured at 50 gigabytes per second.
Because of the way Internet traffic flows, these DDoS attacks created congestion and ripple effects around the web.