Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing

2026-08-01

AI Summary

This work identifies a fundamental flaw in existing DNS-based authorization mechanisms within shared IP environments, where adversaries can exploit legitimate domain ownership to gain unauthorized access to services belonging to other tenants. We uncover, for the first time, a critical verification gap between DNS authorization and shared routing infrastructure, and introduce the Domain Decoupling Attack (DDA): an adversary leverages DNS resolution of an authorized domain to obtain access to a shared edge IP and initiates connections using a hidden target domain consistently in both TLS SNI and HTTP Host headers. Through large-scale domain probing, protocol consistency analysis, and experimental validation across over one million domains spanning six continents, we demonstrate a pervasive vulnerability—95.8% of domains are exposed overall, with CDN-hosted domains exhibiting an exposure rate of 99.26%—confirming the practical feasibility of DDA in real-world networks.

Abstract

Network attackers often conceal malicious communication within legitimate Internet traffic. Existing CDN-based evasion techniques rely on SNI--Host inconsistency, insufficient domain ownership verification, or provider-specific routing rewrites, which limit their applicability in modern CDN environments. We identify a validation gap in DNS-based authorization, where permission derived from an allowed domain applies to a shared IP and can be reused to reach another tenant in both CDN and non-CDN shared-hosting environments. This paper presents the Domain Decoupling Attack (DDA), which resolves an allowed domain to obtain permission for a shared edge IP and subsequently connects to the same address while presenting the hidden domain consistently in both TLS SNI and HTTP Host. Measurements of 1,069,048 domains across six continents produce 18,025,068 successful probes and identify exposure rates of 95.8% overall, 99.26% for CDN domains, 92.75% for non-CDN domains, and 97.7% for non-CDN cross-tenant IPs, while laboratory experiments reveal a structural limitation of DNS-bound access control on shared addresses. These results clarify the security risks of DNS-derived IP authorization and support the evaluation and improvement of access-control mechanisms in CDN and non-CDN shared-hosting environments.

Problem

• Domain Decoupling Attack
• DNS authorization
• shared hosting
• CDN security
• validation gap

Innovation

• Domain Decoupling Attack
• DNS authorization
• shared hosting
• CDN security
• SNI-Host consistency