Knocking on the Front Door: An LLM-Guided Systematic Analysis of DNS Query Processing Vulnerabilities

The Domain Name System (DNS) is defined by simple rules, yet its implementations are notoriously complex. While significant research, such as the TuDoor Attack, has systematically explored logic vulnerabilities in DNS response pre-processing (the back door), a fundamental and equally critical question remains unanswered: what occurs when a malformed query is Knocking on the Front Door? This represents a substantial, unassessed attack surface. To address this research gap, we present QuerySynth, an LLM-guided protocol behavior exploration framework. QuerySynth's core innovation is to automatically deconstruct the vast corpus of DNS RFC documents into a machinereadable Structured Protocol Model (SPM), which in turn guides the systematic generation of a malformed query corpus. We then conducted a large-scale differential analysis of 22 mainstream DNS resolver software, including BIND, Unbound, and PowerDNS. Our analysis reveals a class of severe, exploitable flaws stemming from implementation inconsistencies, which we collectively term the JIGGLE Attack. The JIGGLE Attack includes 3 primitives that an attacker can exploit to: (1) instigate a Pulsing DoS attack via anomalous echo response, (2) establish a Covert Channel for data exfiltration using the same anomalous echo logic, and (3) enhance existing off-path cache poisoning attacks by using Upstream Silence to open a multi-second vulnerability window. We further conducted an in-the-wild active measurement of 44 major public DNS services such as Cloudflare and Google DNS, and of $\mathbf{1. 3}$ million open DNS resolvers. We found that the silence behavior was observed across all $44(100 \%)$ tested services and no less than $852,770(64.84 \%)$ open resolvers, while the anomalous echo primitives affect 18 services $(40.90 \%)$ and a minimum of $\mathbf{7 5, 7 1 1} \boldsymbol{(} \mathbf{5. 7 6 \%} \boldsymbol{)}$ open resolvers. Following the best practice of responsible disclosure, we have responsibly disclosed our findings to related vendors. Our research highlights the urgent need for the standardization of DNS query processing logic.