Reporter: Qifan Zhang, Palo Alto Networks
Hickory DNS's recursive resolver does not perform out-of-bailiwick filtering on negative responses. Bailiwick filtering is a useful mitigation for various cache poisoning attacks. This lack of bailiwick filtering could make exploiting some other DNSSEC verification vulnerabilities easier as well.
Reporter: Qifan Zhang, Palo Alto Networks
Hickory DNS's recursive resolver does not perform out-of-bailiwick filtering on negative responses. Bailiwick filtering is a useful mitigation for various cache poisoning attacks. This lack of bailiwick filtering could make exploiting some other DNSSEC verification vulnerabilities easier as well.