CHANGES.md

This file should record changes worth mentioning from the SIG and its meetings. No particular rules, just what seems appropriate to record. Entries should be in reverse chronological order.

2026-04-30

Renamed "Spoofing or otherwise using unregistered domain names" to "Use of an unregistered domain" and updated the definition to remove references to spoofing.

Renamed "Dynamic DNS Resolution (as obfuscation technique)" to "Obfuscation via Dynamic DNS".

Updated definitions for:

• Use of an unregistered domain
• Creation of Malicious Subdomains Under Dynamic DNS Providers
• Fast flux (added note about "double fast flux")

Updated acknowledgements in the Matrix source document.

2026-04-27

Updated mission statement point 1 to: "Provide globally-accessible descriptions and definitions of DNS Abuse in an operational context for purposes of global policy recommendations."

Added link to DNS Abuse Techniques Matrix to left nav.

Republished Fast-flux, DGA, cache poisoning, and DNS tunneling stakeholder advice documents with small changes to wording for consistency.

Published CONTRIBUTORS.md.

2026-04-23

HTML version changes (https://firstdotorg.github.io/dns-abuse-sig/)

• "CSIRT" -> "CSIRTs"
• "DNS tunneling - tunneling another protocol over DNS" -> "DNS Tunneling"
• "Dynamic DNS resolution: Fast flux (as obfuscation technique)" -> "Fast Flux"
• "Spoofing or otherwise using unregistered domain names" -> "Use of an unregistered domain"

2026-04-16

• Updated contributors list on Matrix and CONTRIBUTORS.md
• Changed "CSIRTs / ISACs" to just "CSIRTs"
• Updated notes about how the term "DGA" is used, and made consistent across documents
• Shortened the term "DNS Tunneling" from its longer form
• Updated "fast flux" everywhere to use the shorter version without clarifications
• Noted that there are legitimate uses of fast flux, in the stakeholder advice
• Fixed "spoofing of a registered domain (for abuse)" in DNS Abuse Techniques Matrix

2026-06-06

HTML version updates:

• CSIRT definition updated
• Nav bar update - CSIRTs/ISACs -> CSIRT

2026-04-05

Created v1.3 of the DNS Abuse Techniques Matrix Updated lame delegations detection capabilities Changed ordering of CHANGES.md updates

2026-02-05

Created CHANGES.md (yes, after the first change!)

2026-01-22

Finished going through the TODO list.

• DNS Abuse SIG
  • DNS Abuse Techniques Matrix
  • Stakeholder Advice
    • Detection
      • Creation of Malicious Subdomains Under Dynamic DNS Providers
      • DNS Cache Poisoning
      • DGA Domains
      • DNS as a Vector for DoS
      • DNS Beacons - C2 Communication
      • DNS Rebinding
      • DNS Server Compromise
      • DNS Tunneling
      • DoS Against the DNS
      • Domain Name Compromise
      • Fast Flux
      • Infiltration and exfiltration via the DNS
      • Lame Delegations
      • Local Recursive Resolver Hijacking
      • Malicious registration of (effective) second level domains
      • Obfuscation via Dynamic DNS
      • On-path DNS Attack
      • Stub Resolver Hijacking
      • Spoofing of a Registered Domain
      • Use of an Unregistered Domain
  • Code of Conduct & Other Policies
  • Examples of DNS Abuse