Out of those four calls: One uses AI_NUMERICHOST and thus doesn't do any DNS client activity. A second isn't supplied arbitrary domain names as input, they be

Out of those four calls: One uses AI_NUMERICHOST and thus doesn't do any DNS client activity. A second isn't supplied arbitrary domain names as input, they being the ones configured for the location of a specific back-end data source by the server administrator. The third is used only inside a "zone transfer" subsystem and again isn't supplied arbitrary domain names as input, the domain names again being in local data specified by the server administrator. And the fourth is not even part of the executable program, the code being disabled with #if 0 . The "S" in "DNS" stands for "system", not "server", by the way. A rogue DNS server would "own" other DNS servers.