DNS Fail-Open Flaw in SSRF Checks Can Expose Internal Services to Attack

A common but dangerous flaw in Server-Side Request Forgery (SSRF) defenses occurs when a URL-rendering service defaults to 'allow' if DNS resolution fails, instead of blocking the request. This fail-open behavior creates a security gap because a later DNS retry, resolver change, or DNS rebinding attack can resolve a hostname to a private IP that the original check never evaluated. Secure implementations should fail closed on DNS errors and apply the same SSRF validation to every browser sub-request — including images, iframes, redirects, and stylesheets — not just the initial URL. Developers are advised to reject non-HTTP(S) schemes upfront, block all private and special-use IP ranges across address families, and ensure regression tests specifically assert a block reason when DNS resolution is forced to fail. While fail-closed DNS behavior may cause occasional availability issues during resolver outages, it is considered the correct security trade-off for services that fetch attacker-controlled URLs.