Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →A DNS check only protects an outbound request if the HTTP client connects to the address that was checked. If the client looks up the hostname again, an attacker may change its DNS answer between validation and connection, directing the request to an internal or otherwise forbidden destination. Resolve and validate the destination, then bind the connection to a validated IP address while preserving the original hostname for HTTP, TLS, and certificate checks.
How DNS rebinding bypasses SSRF validation
Server-side request forgery (SSRF) occurs when an application makes a request to a destination an attacker can influence. A hostname allowlist or an initial DNS check may appear to constrain that request, but DNS answers can change. If the application checks one answer and its HTTP client performs a fresh lookup before opening the socket, the second answer may point somewhere the application did not permit.
As an Amazon Associate I earn from qualifying purchases.
OWASP warns that domain allowlisting alone does not prevent DNS rebinding. A 2024 USENIX study describes the safer alternative as reusing the resolved and validated address—often called IP pinning—rather than letting a later lookup choose the connection destination. OWASP’s SSRF Prevention Cheat Sheet and the USENIX 2024 study provide the underlying guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
What a custom resolver must enforce
The resolver is part of the security boundary only if its validated result controls the actual socket connection. A safe flow is:
#1 Best Overall
- Parse the URL with a well-defined URL parser. Reject malformed input and schemes the feature does not need.
- Resolve the requested hostname. Consider both A (IPv4) and AAAA (IPv6) answers; do not validate only whichever address family happens to be returned first.
- Apply the destination policy to the results. Reject addresses outside the policy. If the hostname has multiple answers, ensure the client cannot select an unchecked one.
- Connect to a validated address without another unchecked lookup. Use a resolver or connection interface that lets the application supply the chosen address. OWASP cites curl’s custom address-resolution capability as an example.
- Keep the requested hostname for protocol identity. The HTTP
Hostheader, TLS SNI, and certificate verification should use the original hostname even though the socket connects to the validated IP address.
These details are related but not interchangeable: the IP address controls where the socket goes, while the hostname is still needed to identify the intended HTTP and TLS service. A custom resolver that checks an address but allows the client to replace it with a new DNS lookup does not close the gap.
Choose a destination policy that fits the feature
The right policy depends on whether the application knows its intended destinations. OWASP favors allowlisting when those targets are known and warns that denylisting is bypass-prone. The USENIX study also discusses challenges with denylist-based defenses.
| Application need | Policy to consider | Key trade-off |
|---|---|---|
| The feature calls a known set of services | An explicit hostname or service allowlist, combined with validation of the actual connection address | The list must be complete and maintained as trusted services change; an overly broad entry can admit unintended hosts. |
| The feature must accept arbitrary destinations | A carefully maintained network policy that classifies and rejects forbidden destinations | Coverage and update burden are higher, and denylist-style rules can be bypassed if classification is incomplete. |
Neither policy replaces connection-time enforcement. Whichever policy you choose, confirm it covers IPv4 and IPv6 and remains in force for redirects, retries, and fallback connections.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Close the less obvious connection paths
Redirects
A permitted URL can redirect to a different hostname or address. Disable automatic redirect following, or inspect and validate every redirect target before allowing the next connection. Do not assume that validating only the first URL constrains the eventual destination.
Retries and fallback connections
HTTP clients may retry a request or attempt another address after a connection failure. Make sure each path uses only addresses validated under the same policy. A fallback that performs its own hostname lookup can undo the protection provided by the initial resolver.
IPv4 and IPv6
Apply destination rules to both A and AAAA answers. If the client can use either address family, validating only IPv4 while allowing an unchecked IPv6 connection leaves a path around the policy.
Rank #4
Use DNS monitoring and cloud protections as additional layers
Resolver ordering and monitoring can help surface unexpected local or internal DNS answers, but they do not ensure the client connects to the address that was checked. The security decision must remain attached to the connection itself.
In cloud environments, SSRF can also expose metadata services. OWASP identifies AWS IMDSv2 as a defense-in-depth measure against some SSRF cases. It complements—rather than replaces—application-layer destination validation and connection pinning.
Best Value
- Used Book in Good Condition
What the 2024 study’s counts do—and do not—show
In the SSRF-capable flows analyzed by the USENIX authors, the study reports 38 with no validation, 26 using category allowlisting, 10 using denylisting, and 12 using regex. It also reports finding no DNS-based defenses in its analyzed cases. These are study-sample findings, not estimates for all applications; the categories should not be added or compared without consulting the paper’s methods.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
