DNS Security

Cybersecurity 17 Sep 2026 7 min read

DNS Rebinding Preserves Web Origin While Changing Network Destination

DNS Rebinding Preserves Web Origin While Changing Network Destination A browser can load active content from a public server, keep that content in the same web origin, and later send requests bearing the same hostname to a private address. No origin tuple has changed. The network destination has. That mismatch is the core of DNS rebinding. Web origins are principally identified by scheme, host, and port, while DNS maps a hostname to network addresses outside that tuple. When a name controlled by an attacker resolves differently over time, origin checks and network-location checks can describe two distinct security boundaries.

Cybersecurity Browser Security

Cybersecurity 14 Sep 2026 7 min read

Dangling DNS Records Can Outlive the Services They Point To

A hostname can remain part of an organisation’s public identity long after the application behind it has disappeared. The DNS record still resolves, certificates may have existed for years, links remain in old messages, and browser cookies may still be scoped broadly enough to include the name. Yet the external service named by that record may have been deleted and returned to a provider’s pool of available resources. That mismatch creates the conditions for subdomain takeover. The core problem is not DNS compromise. The authoritative zone can be operating exactly as configured. The failure sits between two control planes: DNS still delegates traffic toward an external platform, while the platform no longer associates the referenced resource with the domain owner.

Cybersecurity DNS Security

Cybersecurity 13 Sep 2026 8 min read

DNS Rebinding Turns Browser Reachability Into a Security Boundary

A service bound to a private address often feels insulated from the public web. An administrative panel on a home router, a development daemon on a laptop, or an internal HTTP endpoint may have no public route at all. Yet a browser on the same network can often reach it, and that browser also processes content from arbitrary public sites. DNS rebinding exploits the seam between those facts. A hostile site can use a domain it controls, arrange for that name to resolve to different addresses over time, and attempt to make browser requests under one web origin reach a service that was never intended to receive traffic from public content.

Cybersecurity DNS Security