# Rebind protection

DNS rebinding is an attack where a website you visit makes its own domain suddenly resolve to a private address inside your network, such as your router or a smart device. Your browser then talks to that internal device believing it is still talking to the website, bypassing the boundary between the internet and your home or office network.

## What we refuse

**Any answer that points into private or internal address space.** With rebind protection on, a public lookup that returns a private, local or otherwise non-routable address is refused entirely, including answers hidden behind chained aliases and private IPv4 addresses wrapped inside IPv6 answers. One bad address in an answer refuses the whole answer, so an attacker cannot smuggle a private address in next to public ones.

## When you need the allowlist

**Some legitimate services intentionally return private addresses.** Media servers and mesh VPNs (Plex-style and Tailscale-style setups) resolve their own domains to addresses inside your network on purpose. Add those domains to your rebind allowlist and they work again; the entry covers the domain and all its subdomains.

The rebind allowlist bypasses only rebind protection. A domain on it is still checked against threat lists and your other rules, so allowing your media server never opens a hole in threat blocking.

## Control

Rebind protection is a per-configuration switch. Leave it on unless you run unusual infrastructure; the allowlist handles the normal exceptions.

Back to [features](index.md).