BIND 9 Cache Poisoning and Layered DNS Security

Overview

BIND 9 cache poisoning is examined from resolver architecture to root-cause remediation. The series explains how transaction IDs, UDP source ports, and RRset ordering drew on one recoverable PRNG state; how observations could become predictions and, conditionally, a forged delegation cached for later clients; and what the measured results do and do not establish across versions, roles, loads, and external tests. It then separates the ISC patch from DNSSEC, encrypted DNS, access controls, protective DNS, logging, role separation, and resilience. The durable lesson is to trace state, outputs, observability, acceptance, and independent failure boundaries rather than count random-looking bits.

Learning outcomes

BIND 9’s tested weakness linked transaction IDs and UDP source ports through a shared, recoverable PRNG state.
Observable RRset ordering and repeated TXID outputs could support state inference, but inference still preceded prediction, racing, acceptance, and cache persistence.
The study found highly reliable results in named versions and conditions, not a universal compromise rate for every deployment.
ISC’s fixed-release path addresses the generator; DNSSEC, encrypted DNS, access control, visibility, and resilience protect different boundaries.

Keywords

BIND 9PRNGDNSCacheResolverXoshiro128**DNSSECTXIDQNAMEEntropy

Chapters

BIND 9: Why TXIDs and Ports Fall Short

Map the cache boundary behind two linked defenses

10 min · Map the cache boundary behind two linked defenses

10 min

BIND 9: One PRNG, Three Outputs

How RRsets, TXIDs, and ports become linked

10 min · How RRsets, TXIDs, and ports become linked

10 min

BIND 9: From Prediction to Poisoning

Why races, roles, and features change the path

11 min · Why races, roles, and features change the path

11 min

BIND 9 Experiments: Results and Limits

Separate measured success from deployment certainty

13 min · Separate measured success from deployment certainty

13 min

BIND 9 Patch and Layered DNS Controls

What DNSSEC, encryption, and access limits do differently

16 min · What DNSSEC, encryption, and access limits do differently

16 min

BIND 9: Entropy and Trust Architecture

Trace dependencies beyond random-looking fields

14 min · Trace dependencies beyond random-looking fields

14 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-6 Premium

FAQ

Why did random ports and transaction IDs fail in BIND 9?

They failed to provide independent uncertainty because both were derived from a shared PRNG state that could be inferred through other observable behavior.

How could BIND 9 PRNG outputs lead to cache poisoning?

Recovered outputs could help predict a later query’s TXID and source port, but poisoning still required a matching forged response to win a race and pass checks before a false delegation was cached.

What do the BIND 9 attack experiments actually prove?

They establish highly reliable prediction and poisoning in specified versions, variants, protocols, and controlled conditions; they do not establish a universal compromise rate for every deployment.

What should operators do about CVE-2025-40780?

Operators should inventory affected BIND recursive and forwarding services and move them to an ISC-listed fixed release. They should verify every instance and add independent controls such as DNSSEC, access restrictions, logging, and resilience.