People may be interested in a discussion we had about the trust-dns-resolver and some preventative measures in this area: https://github.com/bluejekyll/trust-dn

People may be interested in a discussion we had about the trust-dns-resolver and some preventative measures in this area: https://github.com/bluejekyll/trust-dns/issues/347 https://github.com/bluejekyll/trust-dns/issues/347 The thing I’m most disappointed with is that because we’ve been so lax about 127.0.0.1 and it’s usage, it’s become a means of different applications to blackhole requests suchas ad-blocking networks. Better than that though, are the applications that are using localhost resolution from public names to communicate with local versions of their applications from the browser. The sad thing, is that because of these we can’t just make a simple resolution policy. The one I would like to be true is that only localhost names can resolve to localhost (this doesn’t require any remote resolution), and that you must whitelist private domains for private address spaces (e.g. 10/8). For localhost it’s a very simple area in resolution code to drop RData with 127.0.0.1, private address spaces would need a little more but still easy to identify when to apply it. For now it seems that we have to rely on applications to do a better job of using things like TLS to validate the endpoints to which they are connecting and verifying that the IP is in the expected scope.