Hacker News new | ask | show | jobs
by throwaway2048 2221 days ago
The best way to protect against DNS rebinding attacks is at the DNS server level on your local network.

https://www.nlnetlabs.nl/documentation/unbound/unbound.conf/

the private-address directive and setting cache-min-ttl to a value of higher than 10 minutes or so both do a lot to neuter dns rebinding attacks.

Other DNS Resolvers have similar settings.

1 comments

The DNS resolver/server is still resolving 127.0.0.0/8 and ::1 with these settings.
Not if you tell it otherwise.