DNS Cookies Limit Off-Path DNS Amplification and Forgery
UDP makes DNS efficient, but its source address can be forged by an off-path sender. A small query carrying a victim’s address can trigger a larger response toward that victim, creating reflection and amplification. Forged replies also matter to resolvers because an attacker may try to inject an answer before the legitimate response arrives. DNS Cookies add a lightweight transaction token to this boundary. RFC 7873 defines the COOKIE EDNS option, while RFC 9018 updates the server-side construction so implementations can interoperate, including in multi-vendor anycast deployments. The mechanism is deliberately limited: it raises the cost of off-path forgery, but it is not encryption, DNS data authentication, or protection from an adversary that can observe traffic on path.