SAD DNS Explained
Nov 13, 2020Marek Vavruša, Nick Sullivan
Summary
This post details the SAD DNS attack, which exploits OS networking stack features (like Linux's) to enable DNS cache poisoning by reviving classic attacks. It explains how the attack leverages UDP fragmentation and ICMP error messages to defeat source port randomization. Cloudflare has mitigated this by implementing source port randomization, careful checking of security ranking of cached data, and by eliminating support for fragmented DNS packets, aligning with DNS Flag Day 2020.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available