Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing
Abstract
Network attackers often conceal malicious communication within legitimate Internet traffic. Existing CDN-based evasion techniques rely on SNI--Host inconsistency, insufficient domain ownership verification, or provider-specific routing rewrites, which limit their applicability in modern CDN environments. We identify a validation gap in DNS-based authorization, where permission derived from an allowed domain applies to a shared IP and can be reused to reach another tenant in both CDN and non-CDN shared-hosting environments. This paper presents the Domain Decoupling Attack (DDA), which resolves an allowed domain to obtain permission for a shared edge IP and subsequently connects to the same address while presenting the hidden domain consistently in both TLS SNI and HTTP Host. Measurements of 1,069,048 domains across six continents produce 18,025,068 successful probes and identify exposure rates of 95.8% overall, 99.26% for CDN domains, 92.75% for non-CDN domains, and 97.7% for non-CDN cross-tenant IPs, while laboratory experiments reveal a structural limitation of DNS-bound access control on shared addresses. These results clarify the security risks of DNS-derived IP authorization and support the evaluation and improvement of access-control mechanisms in CDN and non-CDN shared-hosting environments.
Cite
@article{arxiv.2608.00643,
title = {Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing},
author = {Weizhe Wang and Minhong Dong and Jinhao Li and Yao Zhang and Hao Liu and Qiang Hu and Tao Luo and Guangquan Xu and Bin Wu},
journal= {arXiv preprint arXiv:2608.00643},
year = {2026}
}