Should I Trust You? Rethinking the Principle of Zone-Based Isolation DNS Bailiwick Checking

Should I Trust You? Rethinking the Principle of Zone-Based Isolation DNS Bailiwick Checking

Speakers: Yuxiao Wu

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=R3c8FeRoJjw

Overview

The bailiwick checking principle has served as a cornerstone of DNS security for over 20 years, preventing resolvers from accepting out-of-zone records in DNS responses. This talk presents a comprehensive re-examination of this fundamental mechanism, revealing that the 20-year-old bailiwick principle has failed to keep pace with the modern DNS ecosystem. The researchers analyzed eight popular DNS software implementations and found that seven contain security risks, with two vulnerable to all three newly identified attack methods. The work also assessed real-world impact, finding that approximately half of 600,000 open resolvers and 70% of public DNS providers are vulnerable to the proposed attacks.

The core insight is that modern domain hosting services (such as dynamic DNS providers and free subdomain services) allow different users to control different domains within the same DNS zone -- a scenario the original bailiwick principle was never designed to handle. By controlling any subdomain within a target zone, an attacker can poison the cache for sibling domains and even parent domains within that zone.

Background

▶ Watch: DNS resolution fundamentals and cache poisoning history (0:00)

DNS resolution is a hierarchical process involving clients, name servers, and recursive resolvers. When a resolver receives a client request, it performs a top-down recursive query, following NS records toward the authoritative name servers until it reaches the target. A critical point in this process is caching -- when cached data exists, the resolver may directly return cached answers or use cached information to determine the query path.

Cache poisoning attacks have been a persistent threat to DNS security. Early attacks involved directly inserting resource records for other domains into authoritative response packages, manipulating resolver caches to redirect subsequent queries to attacker-controlled name servers (domain hijacking). The bailiwick principle was developed as a countermeasure, checking records in response packages to ensure they belong to the zone of the queried domain.

Traditionally, all domain names within a DNS zone were controlled by a single entity, making zone-based isolation effective. However, with the emergence of domain hosting services like dynamic DNS providers, free subdomain services, load balancing services, and IoT providers, it has become common for different domains within the same zone to be controlled by different users. This fundamental change in the DNS ecosystem undermines the assumptions behind bailiwick checking.

Key Findings

▶ Watch: New attack model: poisoning sibling and parent domains from subdomain control (4:00)

The researchers searched for the keyword "bailiwick" across 4,470 DNS-related RFCs and found only six documents containing the term. These documents fell into two categories: those that use "bailiwick" to impose requirements without defining it, and those that attempt to define it but acknowledge the concept "causes more confusion than clarity." The most recent RFC concludes that the concept is poorly defined and primarily addresses glue records in additional sections -- only a subset of what DNS software actually checks.

Three categories of attack records were defined:

A-record injection: Directly injecting resource records in the answer section matching the target domain's record type.

Authority record takeover: Using forged CNAME records in the answer section or NS records in the authority section to hijack the target domain's resolution authority.

Glue record poisoning: Injecting fake glue records in the additional section to indirectly hijack domain resolution.

Testing across eight popular DNS software implementations with 20 attack payloads revealed that seven contain security risks, with two vulnerable to all three attack methods, four facing threats from both authority and glue record attacks, and one vulnerable only to authority attacks.

Real-world assessment of 600,000 open resolvers and 30 popular public DNS providers found approximately half of open resolvers and 70% of public DNS providers are vulnerable.

Technical Deep Dive

▶ Watch: Software analysis: referral processing and answer centralization stages (6:00)

The analysis follows the DNS resolution workflow through two stages: referral processing and answer centralization, examining how each software implementation handles bailiwick checking at each stage.

During referral processing, all resolvers check and attempt to use records from both authoritative and additional sections. However, implementations diverge significantly: some resolvers only require the record name to be "less than Q-zone" (effectively ignoring the Q-name), meaning they accept records for sibling domains of the queried name. Others consider records where the name equals Q-zone as valid, allowing cache overrides of parent domains. Notably, BIND takes a more conservative approach by not overriding existing records in the cache when records share the same trust level.

During answer centralization, only six resolvers check and attempt to use records from authority and additional sections. In the answer section, two resolvers only require records to satisfy "name less than Q-zone," while others require "name equals Q-name." In authority and additional sections, four resolvers ignore Q-name requirements entirely, only requiring "name less than or equal to Q-zone."

The attack leverages fragmentation attacks combined with the attacker's control of any subdomain within the target zone. By configuring response fragmented packages, the attacker can inject false responses that pass bailiwick checking because the malicious records belong to the same zone as the queried subdomain, even though they target sibling or parent domains controlled by different users.

Demo / Proof of Concept

▶ Watch: Real-world assessment: half of open resolvers and 70% of public DNS vulnerable (10:00)

The researchers evaluated the attack against both DNS software and real-world resolvers. Four types of popular services that allow users to configure subdomains were identified: dynamic DNS providers, free subdomain services, load balancing services, and IoT providers/large companies. Using one month of data from passive DNS (PDNS), the researchers evaluated the number of subdomains and average daily query numbers for seven service providers meeting the attack requirements, demonstrating significant potential impact.

The fragmentation-based approach combined with zone control of any subdomain enables practical exploitation against the majority of tested resolvers. The distribution of affected resolvers by attack type largely matched the software distribution, with authority record takeover having the greatest real-world impact.

Defensive Implications

▶ Watch: Mitigations: Q-name checks and disabling IP fragmentation (12:00)

For DNS software providers, the primary recommendation is to include Q-name in bailiwick checks -- a surprisingly straightforward fix. The researchers suggest it may even be possible to discard authority and additional section records in answer responses entirely. To validate these mitigations, the researchers queried the top 100,000 domains from the Tranco list and collected referral responses, showing that mitigations identified only a small number of domains with impacted normal resolution behavior, meaning the fix can be deployed without significant disruption.

For service providers, disabling IP fragmentation can prevent most cache poisoning attacks, including the ones presented in this work.

The broader lesson is that protocol mechanisms designed decades ago require continuous security review as the internet ecosystem evolves. The emergence of multi-tenant domain hosting fundamentally changed the trust assumptions behind zone-based isolation, but the defense mechanisms were never updated to reflect this new reality.

Key Takeaways

• The 20-year-old bailiwick principle for DNS cache poisoning prevention is fundamentally broken in modern multi-tenant DNS hosting environments
• Seven of eight popular DNS software implementations contain security vulnerabilities, with two vulnerable to all three attack categories
• Approximately half of 600,000 open resolvers and 70% of public DNS providers are vulnerable to the proposed attacks
• An attacker controlling any subdomain within a DNS zone can poison cache entries for sibling and parent domains in that zone
• Including Q-name in bailiwick checks is a straightforward mitigation that can be deployed without significant impact on normal resolution
• The gap between RFC-defined bailiwick concepts and actual software implementations contributes to inconsistent and vulnerable behavior

About the Speaker(s)

The paper was presented by a surrogate speaker from the China University system on behalf of the original authors, Yuxiao Wu and collaborators, who were unable to attend the conference. The research represents a systematic audit of a fundamental DNS security mechanism, combining RFC analysis, software testing, and large-scale real-world measurement.