DNS glossary
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.DNS rebinding is a security attack that exploits browser same-origin policy by abusing DNS responses to redirect victims' browsers from attacker-controlled public servers to internal private network devices. The attack works by serving JavaScript from a public address with a short TTL, then changing the DNS answer to a private address so the browser treats requests to internal services as originating from the same origin. Mitigation requires a layered approach including recursive resolver filtering to block public names resolving to private addresses, Host header validation on internal services, authentication mechanisms, and browser-level controls to restrict requests to private networks.
DNS rebinding exploits the browser same-origin policy by keeping the hostname constant while changing the underlying IP address from public to private. An attacker controls a domain and its authoritative DNS server, first answering queries with their public server address using a very short TTL. After the TTL expires, the attacker’s server responds with a private address like an internal router or server. The browser treats both responses as the same origin because the hostname remains unchanged, allowing injected JavaScript to reach internal services that typically assume all local network traffic is trusted and require no authentication.
Defense requires a layered approach combining multiple controls. Recursive resolvers should filter responses mapping external names to private address ranges, commonly called rebinding protection. Internal web services must validate the Host header and require authentication before exposing functionality. Browsers should implement controls restricting requests to private networks. Additionally, network administrators should configure exceptions carefully for internal domains that legitimately use private addresses. These controls address the attack at the resolver, browser, and target service levels to prevent exploitation.
Any device with a web interface reachable from the victim’s network that lacks Host header validation or authentication is vulnerable. Common targets include routers, printers, cameras, development servers, build tools, and management interfaces. Enterprise environments are equally exposed despite perimeter firewalls, since the malicious request originates from inside the network on a user’s own device. Internal dashboards and administrative interfaces that assume trusted network access without requiring authentication represent significant risk vectors for attackers seeking to read configurations or trigger unauthorized actions.
The attacker controls a domain and its authoritative DNS server, and relies on the browser trusting the hostname rather than the IP address behind it. The same-origin policy compares origins by scheme, host and port, so a changed IP address does not change the origin.
The attack depends on the resolver honoring the short TTL and on the internal service accepting requests with an unexpected Host header or no authentication. Defenses include resolvers that drop public answers containing private addresses, hosts that validate the Host header, and authentication on internal services.
DNSSEC validates that answers came from the zone owner. In a rebinding attack the attacker is the zone owner, so signed answers pass validation and the attack still works.
TLS does not close the gap by itself. The attacker can obtain a valid certificate for their own hostname, and the real defense is the internal service checking the Host header and requiring authentication.
Enterprise networks are exposed as well. Internal dashboards, development servers, build tools and management interfaces that skip authentication on the assumption of a trusted network can be reached through a user's browser.
Perimeter firewalls see the request as coming from an internal workstation, so they allow it. Controls need to sit in the resolver, the browser or the target service.
Low TTLs are common for legitimate load balancing and failover, so blocking them outright causes false positives. A more reliable signal is a public name that suddenly resolves to a private or loopback address.
Article TTL (time to live) is a setting for each DNS record that specifies how long a resolver caches the DNS query before it expires.
Article RFC 1918 networks are ranges of IP addresses designated for private use on TCP/IP networks.
Article RPZ (Response Policy Zone) is a DNS zone that allows resolvers to rewrite answers to block, redirect, or log queries to risky or disallowed domains, providing administrators real-time security and policy control.
Article DNS filtering controls access to websites and online resources by allowing or blocking DNS queries based on predefined security policies and threat intelligence.
Article DNS hijacking occurs when an attacker changes the IP addresses of a domain's DNS servers to attacker-controlled servers.
Article DNS spoofing is an attack in which falsified DNS information redirects users from legitimate destinations to malicious or unintended IP addresses.
Article DNSSEC (Domain Name Service Security Extension) is a mechanism that uses cryptography to authenticate DNS data and verify the integrity of DNS queries and responses.
Article Split-horizon DNS provides different DNS responses to internal and external users based on their location or network, helping organizations manage access to resources.
DNS is easily recruited as a naive messenger for malicious cyber activity. 'DNS as Hostage' is the 2nd in this 3-part series by BlueCat.
Read more
DNS poisoning (aka DNS cache poisoning or DNS spoofing) uses security gaps in the DNS protocol to redirect internet traffic to malicious websites.
Read more
Bad actors know that DNS makes a great weapon in producing massive amounts of traffic for successful DDoS attacks. Here's how.
Read more
In a DNS attack, DNS is compromised or used as a vector. Learn about the different attack types and how to prevent, detect, and…
Read more
A DNS sinkhole supplies a false domain name in response to a DNS query, preventing connections to malicious or unwanted domains. Learn more with…
Read more
The first DNS persona in this 3-part series, DNS as Facilitator is the naive resolver in helping malware spread throughout your networks.
Read more