DNS Infrastructure Resilience Suite

Suite Overview

DNS is the foundation of domain reachability. This suite evaluates whether authoritative nameservers and recursive resolvers withstand complex cryptographic verification chains, high-cardinality record caching, and malformed signature packets.

BIND 9 RRset Database Exhaustion (CVE-2024-1737)

cve_2024_1737 — Tests ISC BIND 9 lookup table limits under high-cardinality record floods in cache databases.

BIND 9 SIG(0) Crypto CPU Load (CVE-2024-1975)

cve_2024_1975 — Evaluates BIND 9 recursive resolver SIG(0) cryptographic verification CPU consumption.

PowerDNS Delegation Loop Saturation (CVE-2024-25584)

cve_2024_25584 — Probes PowerDNS recursor delegation loop bounds and amplification defense under circular NS referrals.

BIND 9 DNSKEY Verification CPU Load (CVE-2025-8677)

cve_2025_8677 — Sends DNS queries targeting zones with malformed DNSKEY records to test DNSSEC verification CPU bounds.

BIND 9 BRID/HHIT Record Crash (CVE-2025-13878)

cve_2025_13878 — Sends DNS queries for malformed BRID/HHIT resource records to test BIND 9 parser resilience.

BIND 9 Invalid TSIG Assertion Crash (CVE-2025-40775)

cve_2025_40775 — Sends DNS control packets with invalid TSIG signatures to verify BIND 9 assertion failure protection.

Safe Execution

DNS infrastructure tests are strictly reviewed and bounded to confirmed customer-owned authoritative domains or recursor IP addresses.

Related simulations