path: root/modules/rebinding/test.integr/module_rebinding.rpl

; SPDX-License-Identifier: GPL-3.0-or-later
; config options
;	target-fetch-policy: "0 0 0 0 0"
;	module-config: "iterator"
;	name: "."
	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
CONFIG_END

SCENARIO_BEGIN Test protection from DNS rebinding

; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 1000
	ADDRESS 193.0.14.129
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS	K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
ENTRY_END

; net.
ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
net. IN NS
SECTION AUTHORITY
.	IN SOA	. . 0 0 0 0 0
ENTRY_END

; root-servers.net.
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
root-servers.net. IN NS
SECTION ANSWER
root-servers.net.	IN NS	k.root-servers.net.
SECTION ADDITIONAL
k.root-servers.net.	IN 	A	193.0.14.129
ENTRY_END

ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
root-servers.net. IN A
SECTION AUTHORITY
root-servers.net.	IN	SOA	. . 0 0 0 0 0
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
k.root-servers.net.	IN 	A
SECTION ANSWER
k.root-servers.net.	IN 	A	193.0.14.129
SECTION ADDITIONAL
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
k.root-servers.net.	IN 	AAAA
SECTION AUTHORITY
root-servers.net.	IN	SOA	. . 0 0 0 0 0
ENTRY_END

; gtld-servers.net.
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
gtld-servers.net. IN NS
SECTION ANSWER
gtld-servers.net.	IN NS	a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net.	IN 	A	192.5.6.30
ENTRY_END

ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
gtld-servers.net. IN A
SECTION AUTHORITY
gtld-servers.net.	IN	SOA	. . 0 0 0 0 0
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
a.gtld-servers.net.	IN 	A
SECTION ANSWER
a.gtld-servers.net.	IN 	A	192.5.6.30
SECTION ADDITIONAL
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
a.gtld-servers.net.	IN 	AAAA
SECTION AUTHORITY
gtld-servers.net.	IN	SOA	. . 0 0 0 0 0
ENTRY_END

ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
com. IN A
SECTION AUTHORITY
com.	IN NS	a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net.	IN 	A	192.5.6.30
ENTRY_END
RANGE_END

; a.gtld-servers.net.
RANGE_BEGIN 0 1000
	ADDRESS 192.5.6.30
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
com. IN NS
SECTION ANSWER
com.	IN NS	a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net.	IN 	A	192.5.6.30
ENTRY_END

ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
example.com. IN A
SECTION AUTHORITY
example.com.	IN NS	ns.example.com.
SECTION ADDITIONAL
ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

; NS with address pointing into a private range must not be followed
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
attacker.com. IN A
SECTION AUTHORITY
attacker.com.	IN NS	ns.attacker.com.
SECTION ADDITIONAL
ns.attacker.com.		IN 	A	192.168.3.5
ENTRY_END
RANGE_END

; ns.attacker.com.
RANGE_BEGIN 0 1000
	ADDRESS 19.168.3.5
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attacker.com. IN NS
SECTION ANSWER
attacker.com.	IN NS	ns.attacker.com.
SECTION ADDITIONAL
ns.attacker.com.		IN 	A	192.168.3.5
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
www.attacker.com. IN A
SECTION ANSWER
www.attacker.com. IN A	192.0.2.55
ENTRY_END
RANGE_END


; ns.example.com.
RANGE_BEGIN 0 1000
	ADDRESS 1.2.3.4
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.com. IN NS
SECTION ANSWER
example.com.	IN NS	ns.example.com.
SECTION ADDITIONAL
ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A	192.0.2.40
ENTRY_END

; blacklisted IP addresses
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4-0-0-0-0.example.com. IN A
SECTION ANSWER
attack-ipv4-0-0-0-0.example.com. IN A	0.0.0.0
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4over6-0-0-0-0.example.com. IN AAAA
SECTION ANSWER
attack-ipv4over6-0-0-0-0.example.com. IN AAAA	::ffff:0.0.0.0
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4-10-1-2-3.example.com. IN A
SECTION ANSWER
attack-ipv4-10-1-2-3.example.com. IN A	10.1.2.3
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4over6-10-2-3-4.example.com. IN AAAA
SECTION ANSWER
attack-ipv4over6-10-2-3-4.example.com. IN AAAA	::ffff:10.2.3.4
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4-100-127-255-254.example.com. IN A
SECTION ANSWER
attack-ipv4-100-127-255-254.example.com. IN A	100.127.255.254
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4over6-100-127-255-255.example.com. IN AAAA
SECTION ANSWER
attack-ipv4over6-100-127-255-255.example.com. IN AAAA	::ffff:100.127.255.255
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4-127-0-0-1.example.com. IN A
SECTION ANSWER
attack-ipv4-127-0-0-1.example.com. IN A	127.0.0.1
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4over6-127-0-0-1.example.com. IN AAAA
SECTION ANSWER
attack-ipv4over6-127-0-0-1.example.com. IN AAAA	::ffff:127.0.0.1
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4-169-254-255-255.example.com. IN A
SECTION ANSWER
attack-ipv4-169-254-255-255.example.com. IN A	169.254.255.255
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4over6-169-254-0-0.example.com. IN AAAA
SECTION ANSWER
attack-ipv4over6-169-254-0-0.example.com. IN AAAA	::ffff:169.254.0.0
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4-172-16-0-0.example.com. IN A
SECTION ANSWER
attack-ipv4-172-16-0-0.example.com. IN A	172.16.0.0
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4over6-172-31-255-255.example.com. IN AAAA
SECTION ANSWER
attack-ipv4over6-172-31-255-255.example.com. IN AAAA	::ffff:172.31.255.255
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4-192-168-3-8.example.com. IN A
SECTION ANSWER
attack-ipv4-192-168-3-8.example.com. IN A	192.168.3.8
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv4over6-192-168-254-210.example.com. IN AAAA
SECTION ANSWER
attack-ipv4over6-192-168-254-210.example.com. IN AAAA	::ffff:192.168.254.210
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv6-.example.com. IN AAAA
SECTION ANSWER
attack-ipv6-.example.com. IN AAAA	::
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv6-1.example.com. IN AAAA
SECTION ANSWER
attack-ipv6-1.example.com. IN AAAA	::1
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv6-fc00.example.com. IN AAAA
SECTION ANSWER
attack-ipv6-fc00.example.com. IN AAAA	fc00::
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
attack-ipv6-fe80.example.com. IN AAAA
SECTION ANSWER
attack-ipv6-fe80.example.com. IN AAAA	fe80::
ENTRY_END

RANGE_END

STEP 11 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
www.example.com. IN A
ENTRY_END

; recursion happens here, no blacklisted IP address is present
STEP 12 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A	192.0.2.40
;SECTION AUTHORITY
;example.com.	IN NS	ns.example.com.
;SECTION ADDITIONAL
;ns.example.com.		IN 	A	1.2.3.4
ENTRY_END

; test that 0.0.0.0 is blacklisted
STEP 201 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4-0-0-0-0.example.com. IN A
ENTRY_END

STEP 202 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4-0-0-0-0.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::ffff:0.0.0.0 is blacklisted
STEP 211 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4over6-0-0-0-0.example.com. IN AAAA
ENTRY_END

STEP 212 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4over6-0-0-0-0.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that 10.1.2.3 is blacklisted
STEP 221 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4-10-1-2-3.example.com. IN A
ENTRY_END

STEP 222 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4-10-1-2-3.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::ffff:10.2.3.4 is blacklisted
STEP 231 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4over6-10-2-3-4.example.com. IN AAAA
ENTRY_END

STEP 232 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4over6-10-2-3-4.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that 100.127.255.254 is blacklisted
STEP 241 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4-100-127-255-254.example.com. IN A
ENTRY_END

STEP 242 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4-100-127-255-254.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::ffff:100.127.255.255 is blacklisted
STEP 251 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4over6-100-127-255-255.example.com. IN AAAA
ENTRY_END

STEP 252 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4over6-100-127-255-255.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that 127.0.0.1 is blacklisted
STEP 261 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4-127-0-0-1.example.com. IN A
ENTRY_END

STEP 262 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4-127-0-0-1.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::ffff:127.0.0.1 is blacklisted
STEP 271 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4over6-127-0-0-1.example.com. IN AAAA
ENTRY_END

STEP 272 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4over6-127-0-0-1.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that 169.254.255.255 is blacklisted
STEP 281 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4-169-254-255-255.example.com. IN A
ENTRY_END

STEP 282 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4-169-254-255-255.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::ffff:169.254.0.0 is blacklisted
STEP 291 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4over6-169-254-0-0.example.com. IN AAAA
ENTRY_END

STEP 292 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4over6-169-254-0-0.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that 172.16.0.0 is blacklisted
STEP 301 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4-172-16-0-0.example.com. IN A
ENTRY_END

STEP 302 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4-172-16-0-0.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::ffff:172.31.255.255 is blacklisted
STEP 311 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4over6-172-31-255-255.example.com. IN AAAA
ENTRY_END

STEP 312 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4over6-172-31-255-255.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that 192.168.3.8 is blacklisted
STEP 321 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4-192-168-3-8.example.com. IN A
ENTRY_END

STEP 322 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4-192-168-3-8.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::ffff:192.168.254.210 is blacklisted
STEP 331 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv4over6-192-168-254-210.example.com. IN AAAA
ENTRY_END

STEP 332 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv4over6-192-168-254-210.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that :: is blacklisted
STEP 341 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv6-.example.com. IN AAAA
ENTRY_END

STEP 342 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv6-.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that ::1 is blacklisted
STEP 351 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv6-1.example.com. IN AAAA
ENTRY_END

STEP 352 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv6-1.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that fc00:: is blacklisted
STEP 361 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv6-fc00.example.com. IN AAAA
ENTRY_END

STEP 362 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv6-fc00.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

; test that fe80:: is blacklisted
STEP 371 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
attack-ipv6-fe80.example.com. IN AAAA
ENTRY_END

STEP 372 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
attack-ipv6-fe80.example.com. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

STEP 401 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
www.example.com. IN A
ENTRY_END

; it still works if no blacklisted IP address is present
STEP 402 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A	192.0.2.40
ENTRY_END

STEP 501 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
www.attacker.com. IN A
ENTRY_END

; NS for attacker.com. has IP address from private range, it must fail
STEP 502 CHECK_ANSWER
ENTRY_BEGIN
MATCH all answer authority
REPLY QR RD RA REFUSED
SECTION QUESTION
www.attacker.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
explanation.invalid.	TXT	"blocked by DNS rebinding protection"
ENTRY_END

SCENARIO_END