{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/", "item": { "id": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/", "slug": "use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers", "url": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers.md", "json": "https://update.dsesecurity.com/api/v1/posts/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/" }, "title": "Use a domain-specific pfSense rebinding exception for legitimate private DNS answers", "summary": "A necessary private-address answer should not require disabling rebinding protection everywhere.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:20+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 255, "potentially_affected": "This concerns pfSense DNS rebinding controls.", "dse_recommendation": "DSE recommends identifying whether the failure occurs in the DNS answer or at the GUI hostname check before changing controls.", "primary_source": { "name": "Netgate — DNS Rebinding Protections", "url": "https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A necessary private-address answer should not require disabling rebinding protection everywhere.

\n

Source facts

\n

Netgate documents rebinding protection that strips private and local addresses from upstream DNS responses. Legitimate internal names or DNS-based blocklists can require a domain exception, with different configuration syntax for the Resolver and Forwarder. The firewall GUI also has its own hostname protection, which is a separate layer from filtering DNS answers.

\n

Source: Netgate — DNS Rebinding Protections.

\n

Applicability

\n

This concerns pfSense DNS rebinding controls.

\n

DSE recommendation

\n

DSE recommends identifying whether the failure occurs in the DNS answer or at the GUI hostname check before changing controls. Verify the domain owner, expected private destination, and active DNS service. Prefer the narrow domain exception described for that service over allowing every private or loopback response. Keep the approved exception’s purpose and owner visible in the configuration record, and revisit it when the internal naming design changes. For an exception request, require the exact domain, expected private answer, DNS service in use, and business owner. Compare a permitted internal response with an unrelated private-address response that should still be rejected. Keep GUI hostname changes outside that DNS-answer exception unless independently justified.

\n

Verification

\n

Query the intended name through the actual client resolver path and inspect the answer before and after the approved exception. Test an unrelated controlled private-address response to confirm protection remains effective outside the allowed domain. If the GUI rejects the hostname, review its allowed-name configuration separately instead of assuming DNS filtering is still the cause.

\n

Official reference

\n

Netgate — DNS Rebinding Protections. Reviewed October 20, 2026.

", "content_text": "A necessary private-address answer should not require disabling rebinding protection everywhere.\nSource facts\nNetgate documents rebinding protection that strips private and local addresses from upstream DNS responses. Legitimate internal names or DNS-based blocklists can require a domain exception, with different configuration syntax for the Resolver and Forwarder. The firewall GUI also has its own hostname protection, which is a separate layer from filtering DNS answers.\nSource: Netgate — DNS Rebinding Protections.\nApplicability\nThis concerns pfSense DNS rebinding controls.\nDSE recommendation\nDSE recommends identifying whether the failure occurs in the DNS answer or at the GUI hostname check before changing controls. Verify the domain owner, expected private destination, and active DNS service. Prefer the narrow domain exception described for that service over allowing every private or loopback response. Keep the approved exception’s purpose and owner visible in the configuration record, and revisit it when the internal naming design changes. For an exception request, require the exact domain, expected private answer, DNS service in use, and business owner. Compare a permitted internal response with an unrelated private-address response that should still be rejected. Keep GUI hostname changes outside that DNS-answer exception unless independently justified.\nVerification\nQuery the intended name through the actual client resolver path and inspect the answer before and after the approved exception. Test an unrelated controlled private-address response to confirm protection remains effective outside the allowed domain. If the GUI rejects the hostname, review its allowed-name configuration separately instead of assuming DNS filtering is still the cause.\nOfficial reference\nNetgate — DNS Rebinding Protections. Reviewed October 20, 2026.", "content_markdown": "A necessary private-address answer should not require disabling rebinding protection everywhere.\n\n## Source facts\n\nNetgate documents rebinding protection that strips private and local addresses from upstream DNS responses. Legitimate internal names or DNS-based blocklists can require a domain exception, with different configuration syntax for the Resolver and Forwarder. The firewall GUI also has its own hostname protection, which is a separate layer from filtering DNS answers.\n\nSource: [Netgate — DNS Rebinding Protections](https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html).\n\n## Applicability\n\nThis concerns pfSense DNS rebinding controls.\n\n## DSE recommendation\n\nDSE recommends identifying whether the failure occurs in the DNS answer or at the GUI hostname check before changing controls. Verify the domain owner, expected private destination, and active DNS service. Prefer the narrow domain exception described for that service over allowing every private or loopback response. Keep the approved exception’s purpose and owner visible in the configuration record, and revisit it when the internal naming design changes. For an exception request, require the exact domain, expected private answer, DNS service in use, and business owner. Compare a permitted internal response with an unrelated private-address response that should still be rejected. Keep GUI hostname changes outside that DNS-answer exception unless independently justified.\n\n## Verification\n\nQuery the intended name through the actual client resolver path and inspect the answer before and after the approved exception. Test an unrelated controlled private-address response to confirm protection remains effective outside the allowed domain. If the GUI rejects the hostname, review its allowed-name configuration separately instead of assuming DNS filtering is still the cause.\n\n## Official reference\n\n[Netgate — DNS Rebinding Protections](https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/", "url": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Use a domain-specific pfSense rebinding exception for legitimate private DNS answers", "item": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/#article", "identifier": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/", "url": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/", "headline": "Use a domain-specific pfSense rebinding exception for legitimate private DNS answers", "description": "A necessary private-address answer should not require disabling rebinding protection everywhere.", "abstract": "A necessary private-address answer should not require disabling rebinding protection everywhere.", "articleBody": "A necessary private-address answer should not require disabling rebinding protection everywhere.\nSource facts\nNetgate documents rebinding protection that strips private and local addresses from upstream DNS responses. Legitimate internal names or DNS-based blocklists can require a domain exception, with different configuration syntax for the Resolver and Forwarder. The firewall GUI also has its own hostname protection, which is a separate layer from filtering DNS answers.\nSource: Netgate — DNS Rebinding Protections.\nApplicability\nThis concerns pfSense DNS rebinding controls.\nDSE recommendation\nDSE recommends identifying whether the failure occurs in the DNS answer or at the GUI hostname check before changing controls. Verify the domain owner, expected private destination, and active DNS service. Prefer the narrow domain exception described for that service over allowing every private or loopback response. Keep the approved exception’s purpose and owner visible in the configuration record, and revisit it when the internal naming design changes. For an exception request, require the exact domain, expected private answer, DNS service in use, and business owner. Compare a permitted internal response with an unrelated private-address response that should still be rejected. Keep GUI hostname changes outside that DNS-answer exception unless independently justified.\nVerification\nQuery the intended name through the actual client resolver path and inspect the answer before and after the approved exception. Test an unrelated controlled private-address response to confirm protection remains effective outside the allowed domain. If the GUI rejects the hostname, review its allowed-name configuration separately instead of assuming DNS filtering is still the cause.\nOfficial reference\nNetgate — DNS Rebinding Protections. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:20+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/use-a-domain-specific-pfsense-rebinding-exception-for-legitimate-private-dns-answers/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use a domain-specific pfSense rebinding exception for legitimate private DNS answers" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 255, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — DNS Rebinding Protections", "url": "https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html" } } ] } }