The side channel is ICMP redirects. Folks following the guidance from the CIS or NIST benchmarks will have disabled ICMP redirects. For this to work, your rec

The side channel is ICMP redirects. Folks following the guidance from the CIS or NIST benchmarks will have disabled ICMP redirects. For this to work, your recursive DNS server must be publicly accessible and allow ICMP redirects on the server. Most of the public recursive servers are behind load balancers so I would be curious to see penetration testing results of the public recursive systems like Cloudflare, Google, OpenDNS and others like them.