Skip to main content

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsersbrowser already knows where to send the request the instanceinstant you click the link. This is called DNS prefetching.

This behaviour can be disabled by setting the x-dns-prefetch-control HTTP response header to off. I have been recomendedrecommended to do so "for security reasons", but what I fail to understand is - what adverse security or anonymity implications would allowing DNS prefetching would have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is called DNS prefetching.

This behaviour can be disabled by setting the x-dns-prefetch-control HTTP response header to off. I have been recomended to do so "for security reasons", but I fail to understand what adverse security or anonymity implications allowing DNS prefetching would have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browser already knows where to send the request the instant you click the link. This is called DNS prefetching.

This behaviour can be disabled by setting the x-dns-prefetch-control HTTP response header to off. I have been recommended to do so "for security reasons", but what I fail to understand is - what adverse security or anonymity implications would allowing DNS prefetching have?

edited tags
Link
Anders
  • 65.8k
  • 25
  • 185
  • 226
Tweeted twitter.com/StackSecurity/status/726887609180520450
Source Link
Anders
  • 65.8k
  • 25
  • 185
  • 226

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is called DNS prefetching.

This behaviour can be disabled by setting the x-dns-prefetch-control HTTP response header to off. I have been recomended to do so "for security reasons", but I fail to understand what adverse security or anonymity implications allowing DNS prefetching would have?