CVE-2022-30256

What it actually does

The flaw allows revoked, expired, or taken-down domain names to remain resolvable for extended periods by conforming to de facto DNS specifications, bypassing existing mitigation patches for ghost domain names.

Why it matters to the business

Continued resolution of malicious or expired domains can sustain attacker infrastructure, increasing exposure to ongoing threats and complicating domain-based security controls across dependent systems.

How an attack unfolds

Attackers leverage the resolver's handling of variant V1 unintended resolution to keep revoked domains active, enabling persistent use in campaigns that rely on DNS operational practices.

How to fix it

Upgrade github.com/Xhofe/alist (go) to version v2.1.1 or later; apply vendor patches for MaraDNS Deadwood if also present in the environment.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed release and test resolution behavior against known revoked domains to verify they are no longer returned.

Typical attack path

1. Locate or register a revoked/expired domain name
2. Query the vulnerable resolver to obtain resolution
3. Abuse the resulting DNS response for malicious infrastructure such as C2 or phishing

How to detect it

Inspect DNS query logs and resolver caches for resolutions of domains that should be revoked or expired; correlate with known malicious domain lists.

What your security team should do

• Prioritize upgrade to the stated fixed version
• Audit DNS resolver configurations for unintended resolution paths
• Review downstream dependents for similar exposure