DNS cookies
DNS cookies (RFC 7873) are an optional EDNS0 extension that lets a DNS client and server exchange a pair of opaque tokens -- a client cookie and a server cookie -- attached to plain UDP queries and responses. Once a server has issued a client a server cookie, it can reject or deprioritize any later query claiming to be from that client but presenting the wrong cookie, giving lightweight protection against off-path attackers who spoof a query's source address to poison a cache or trigger a reflected denial-of-service response, without the overhead of switching every query to TCP. Support is optional and not universal: a resolver or authoritative server that doesn't implement DNS cookies simply ignores the extension and falls back to ordinary unauthenticated UDP behavior.
By AdminKit team, Netbase JSC · Updated