3 ms·
If you run your own resolver those can be trivially filtered out. For example in unbound there's private-address: <IP address or subnet> Giv
by the8472 9y ago
If you run your own resolver those can be trivially filtered out.
For example in unbound there's
private-address: <IP address or subnet>
Give IPv4 of IPv6 addresses or classless subnets. These are
addresses on your private network, and are not allowed to be
returned for public internet names. Any occurrence of such
addresses are removed from DNS answers. Additionally, the DNSSEC
validator may mark the answers bogus. This protects against
so-called DNS Rebinding
- xorcist 9y agoFiltering out 127.0.0.1, which is likely what these rebinding attacks utilizes, may cause problems if you run spam filters or ad blockers that use these addresses in their replies. Just something to be aware of, especially of your resolver services other clients than your personal localhost.
- the8472 9y agoAdblockers shouldn't be affected since those usually are operated locally, either as part of the resolver itself or downstream by a user which can always overrule the DNS results. And for dns blacklists you can exempt their domains from these rules.