Sam Trenholme’s blog

MaraDNS bugfix

August 24, 2026

I fixed a very minor security bug found in MaraDNS by an AI security audit.

MaraDNS DNS-over-TCP issue

There is a minor DNS-over-TCP issue with Deadwood. The issue is not serious enough to merit a CVE report nor to make a new MaraDNS release.

If DNS-over-TCP was enabled (it is disabled by default), a remote DNS server could cause the DNS-over-TCP service to not function with a denial of service attack. The issue does not affect DNS-over-UDP operation. This bug was fixed on August 24, 2026, but is not a serious enough bug to merit a new release, since DNS-over-TCP is disabled and really should not be enabled.

If tcp_listen is not in your dwood3rc file, this bug does not affect you. If tcp_listen is in your dwood3rc file but has the value 0, this bug still does not affect you. Only people who have set tcp_listen to have a value of 1 are affected.

The bug was patched in commit 13c0af9d3c, with a new Windows binary made (a previous commit fixes the source code). There is also a patch available.

This is a minor bug because:

DNS-over-TCP is disabled by default in Deadwood, there is no example configuration file with DNS-over-TCP enabled
People should not enable DNS-over-TCP; it’s not needed for the use cases Deadwood is meant to address (someone using a DNS server in a small work or home network, usually on a small 32-bit or 64-bit router—Deadwood was written to run well on a 32-bit system)
If people want an enterprise DNS server with DNS-over-TCP, they need to pay for an enterprise server. I was not paid a single cent to address this AI-generated security report.
This bug does not merit a new MaraDNS release. I have recompiled the Windows binary with this patch, and have made a one-line patch for this issue. I will make a new release sometime in 2027 with this bug fixed.
It’s nice to see that the only legitimate issues AI generated security reports have been finding with MaraDNS are issues with the almost always disabled DNS-over-TCP code in Deadwood, and no attack worse than denial of service of just DNS-over-TCP (OK, another AI generated security report found an issue with the mqhash.c program which didn’t even compile since 2022, and was never part of the services MaraDNS uses, nor ever compiled by default).