DNS

DNS tunneling is a classic covert data exfiltration technique that encodes data into DNS query requests; because the DNS protocol must be allowed through in almost all network environments, traditional firewalls find it very difficult to block completely.

An A record is used to map a domain name directly to an IPv4 address, while a CNAME record is used to point one domain name to another domain name.

Supply-chain-level MCP attack patterns include typosquatted servers and rug pulls (i.e., tool definitions that are silently altered after being approved).

The hierarchical structure of the domain name system is: ICANN (top-level governance) → registries (managing specific top-level domains such as .com and .net) → registrars (providing registration services to end users).

DNS hijacking refers to attackers tampering with DNS resolution results to redirect users' access to legitimate websites toward malicious servers

SPF通过DNS TXT记录声明哪些IP地址被授权代表某域名发送邮件

DNS queries are almost never blocked by enterprise firewalls, and traditional security devices focus their monitoring on HTTP/HTTPS traffic while giving insufficient scrutiny to DNS traffic.

The TTL (Time To Live) value determines how long DNS resolution results survive in the cache and directly affects the speed at which DNS changes take effect.

Users can block their TV from sending telemetry data to manufacturer servers through router or DNS-level tools.

DNS propagation typically requires anywhere from several hours to 48 hours.

Classic amplification attack cases have appeared on UDP protocols such as DNS, NTP and Memcached, with amplification factors reaching tens of times or even tens of thousands of times.

Claroc researchers discovered these Muse conversation links through public DNS records.

A network protocol is a set of rules that both communicating parties must follow in a computer network, such as TCP/IP, HTTP, DNS, etc., and usually involves layered models and state machines.

DNS has no single point of control and cannot be dictated by any one company or government; the rules give a seat each to governments, registries, registrars, security advisors and ordinary internet users, negotiated in public meetings.

AI agents are becoming heavy DNS users, and no one deliberately decided this. An agent that can browse the web or call tools must likewise resolve domain names, trusts the answers the same way a browser does, and often no one glances at the link first.

DNS is essentially a distributed hierarchical database responsible for translating human-readable domain names into machine-routable IP addresses, starting from the root zone and going down through top-level domains, second-level domains and subdomains, with each layer independently managed by different organizations, forming a delegation structure.

DNSSEC addresses DNS's fundamental flaw through digital signature mechanisms: traditional DNS responses have no integrity checking, so a man-in-the-middle can forge responses and steer users to malicious addresses (cache poisoning). With DNSSEC enabled, a zone generates an RRSIG signature for each record, and resolvers verify the signatures along the chain of trust, setting the AD flag in the response header only if verification passes.

This hijacking experiment redirects the PS5's RTMP connection to a self-built RTMP receiving server by controlling DNS resolution or routing on the local network.

Nearly all network environments allow DNS query traffic to pass through, making it susceptible to abuse as a channel for data exfiltration or command delivery.

Even when a sandbox blocks conventional outbound HTTP/HTTPS connections, DNS resolution requests are often still permitted, thereby creating an escape path.