The IETF published RFC 10023, a DNS convention allowing domain owners to signal that their registered domain is for sale using a _for-sale TXT record. The standard has quickly gained adoption with multiple tools and services already implementing support.
Nandns is a free, self-hostable dynamic DNS service compatible with DuckDNS that allows users to create subdomains pointing to their current IP address, with automatic updates via scripts or API. The service offers a free tier with up to 6 subdomains and a premium plan for 60€/year supporting up to 100 subdomains, using Gmail-only authentication.
Repology.org domain is on registrar hold and resolves to 127.0.0.1, though the underlying server remains operational. This causes API clients like Renovate's repology datasource to fail with connection errors.
DNSCrypt is a network protocol that authenticates and encrypts DNS traffic between users and recursive name servers, preventing eavesdropping and man-in-the-middle attacks while mitigating UDP-based amplification attacks. Originally designed by Frank Denis and Yecheng Fu, it has been adopted by major public DNS resolvers including OpenDNS, Yandex, CloudNS, AdGuard, and Quad9, with implementations available across multiple operating systems.
Cloudflare's 1.1.1.1 DNS resolver now validates post-quantum DNSSEC signatures using ML-DSA-44, a NIST-standardized algorithm, to prepare DNS infrastructure for potential quantum computing threats. The implementation addresses the challenge of handling much larger signatures (2,420 bytes) while maintaining backward compatibility with conventional algorithms.
A user configures Pi-hole with IPv6 support on a home network despite ISP router limitations. By enabling Router Advertisements with high preference on Pi-hole, devices prefer the local DNS server over the ISP's DNS, effectively circumventing the locked-down router's IPv6 restrictions.
Portspan is a self-hosted ngrok alternative that exposes local development ports via predictable wildcard subdomains. It uses frp for tunneling and routing, Nginx for TLS termination, and provides setup scripts, security documentation, and client tooling for Linux servers.
A Nix binary cache requires only three HTTP functions: serving nix-cache-info, narinfo metadata files, and compressed archives. GitHub Pages can host a free Nix substituter due to its permissive CORS policy, and alternative storage backends like Git or DNS can implement the same interface via HTTP proxies.
Cloudflare's 1.1.1.1 resolver now validates DNSSEC signatures using ML-DSA-44, a post-quantum algorithm standardized by NIST, to prepare DNS security for potential future threats from quantum computers. The main challenge is that ML-DSA-44 signatures are 2,420 bytes—nearly 38 times larger than current algorithms—requiring larger DNS responses while maintaining backward compatibility with older resolvers.
InSpectre is a self-hosted network visibility and security tool that discovers devices on a LAN using ARP sweeps and passive sniffing, performs CVE scanning, enables device blocking via ARP MITM, tracks user presence, and manages Docker containers — all without cloud connectivity or agents.
Researchers demonstrate that a malicious local application collaborating with a remote adversary can hijack TCP connections and poison DNS caches by inferring sensitive connection state like TCP sequence numbers and UDP source ports. The attacks exploit standard socket API calls, IP options, and OS features across Linux, Android, Windows, macOS, and iOS, with patches released by major vendors following responsible disclosure.
Let's Encrypt experienced an outage on September 11, 2026, caused by a DNS resolver issue in their secondary validation system that elevated Domain Control Validation failure rates. The company identified the problem and reverted the change, expecting to restore operations within 15 minutes.
This technical post explains DNS wildcard records, which match any subdomain via patterns like *.example.com, and presents three detection approaches for identifying them during subdomain enumeration in bug bounty hunting and CTF activities. The post details how wildcards work per RFC specifications, their interaction with load balancers, and practical methods including querying nonexistent subdomains, querying the wildcard directly, and counting returned IP addresses.
A critique of organizational login infrastructure that makes phishing attacks nearly impossible for users to detect. The author argues that companies' use of multiple subdomains and third-party services for authentication creates URLs indistinguishable from scams, and advocates for organizations to consolidate logins under a single recognizable root domain to help users identify legitimate services.
Cloudflare's 1.1.1.1 DNS resolver now validates post-quantum DNSSEC signatures using ML-DSA-44, a NIST-standardized algorithm, to prepare DNS infrastructure for potential quantum computer threats. The transition presents challenges due to the large size of post-quantum signatures (2,420 bytes) and the need to maintain backward compatibility with older resolvers during the migration.
Retune FM restores Internet Radio functionality to older Hi-Fi receivers from Denon, Marantz, Yamaha, and other brands that lost access when the vTuner directory became unavailable. Users can regain their station lists by changing a single DNS setting on their receiver to point to Retune FM's server, with a free 90-day trial followed by optional donations.
A user configured their own DNS resolver using Unbound instead of relying on Google, Cloudflare, or their ISP to prevent those providers from tracking their web activity. After setup, they observed improved application responsiveness due to local caching and reduced DNS query times from milliseconds to microseconds.
A security researcher analyzed exe.dev after its funding round and discovered several interesting design choices, including SSH access without pre-configured keys via GitHub public key lookup, and a GitHub integration that uses a local proxy hostname to access private repositories without storing credentials on the VM.
Microsoft released 973 CVEs on Patch Tuesday following Labor Day, the largest monthly release on record, including 113 Critical vulnerabilities and two confirmed exploited flaws. CVE-2026-81963, a Windows Update Stack privilege escalation being actively exploited, and CVE-2026-69730, a DNS Server remote code execution, pose immediate risks to Windows systems and domain controllers.
The article describes three practical uses of Tailscale: securely sending millions of honeypot webhooks to Splunk via a private network, running a reverse proxy with Caddy in Google Cloud to expose services with TLS encryption, and accessing a private DNS server (PiHole or Adguard Home) over Tailscale for ad-blocking and tracking prevention anywhere.