DNS Rebind Protection - on or off?

[SkippyP]

Hello. If using an upstream resolver that already has rebind protection, is it of any value to also keep it enabled on the router? Any harm in keeping it enabled? Does it add significant overhead?

 

[Tech9]

You may have it enabled, it won't affect the router's performance in any noticeable way, but you may also get warning messages in system log about possible rebind attack when upstream filtering DNS service blocks something and returns 0.0.0.0 address.

 

[SkippyP]

Thanks. That’s fine and I’ll keep it enabled. Warning messages in the system log don’t bother me.

 

[Tech9]

You are perhaps using DoT and filtering upstream DNS resolver. You can keep all three options above "Prevent client auto DoH" to default Disabled state. Keep it simple. Folks like to turn things on/off even when no change is needed just because the option is available.

 

[SkippyP]

Thanks again. Yes, I’m using DoT to an upstream resolver with filtering (malware protection). The only one enabled is Rebind Protection. The other two settings are disabled. If there’s no harm and no overhead with Rebind Protection, I’ll just leave it enabled.

 

[Ripshod]

Thanks again. Yes, I’m using DoT to an upstream resolver with filtering (malware protection). The only one enabled is Rebind Protection. The other two settings are disabled. If there’s no harm and no overhead with Rebind Protection, I’ll just leave it enabled.

I've had the Rebind Protection active for years and have never seen any problems. Log fooding has never happened to me, just an occasional message (once or twice a day).
But, to be fair, every connected device is mine and is set up by me, and the messages are only caused by IoT devices that I have only limited control over. As always, ymmv