Collected research

Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style

Timo Longin and Clemens Stockenreitner · SEC Consult

A survey of closed, non-publicly-reachable DNS resolvers, reached indirectly by sending mail that forces a target mail server to query an attacker-controlled authoritative nameserver for SPF, DKIM and DMARC records. Resolvers found without source port randomisation are poisonable by a classic Kaminsky attack, enabling MX redirection, password-reset interception and account takeover.

Record

Researcher

Timo Longin and Clemens Stockenreitner

Published by

SEC Consult

Topic

Other

In the archive

• Collected in the 2022 research round

Related sources

• Research analysis server

Tags

• cache-poisoning
• dns
• smtp
• email
• auth-bypass
• large-scale-scan
• measurement-study
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Timo Longin and Clemens Stockenreitner, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.