Kerberos Relay via DNS CNAME Expands Identity Attack Surface in Active Directory
Security researchers have disclosed a new Kerberos relay technique that abuses DNS CNAME records to bypass existing relay mitigations in Active Directory environments.
The method expands the attack surface for credential relay attacks by exploiting how Windows systems construct Kerberos service ticket requests after resolving DNS aliases.
A proof of concept has been released, confirming practical exploitation across modern Windows versions.
What is the technique
The attack leverages a core behavior in Windows name resolution. When a client receives a DNS CNAME response, it follows the alias and uses the CNAME hostname as the Service Principal Name (SPN) when requesting a Kerberos service ticket.
An attacker who can manipulate DNS responses can coerce a victim system into requesting Kerberos tickets for attacker-controlled services, without requiring user credentials.
Attack prerequisites
Successful exploitation requires the attacker to obtain a position on the local network that allows DNS traffic manipulation. Common techniques include:
ARP poisoning
DHCPv6 poisoning using MITM6
Other on-path man-in-the-middle methods
Once in position, the attacker responds to legitimate DNS queries with a malicious CNAME record pointing to infrastructure under their control.
Exploitation flow
When a victim attempts to access a legitimate internal resource:
The attacker injects a DNS CNAME response redirecting the request
The victim resolves the alias and constructs a Kerberos TGS request using the attacker-chosen SPN
The victim connects to the attacker-controlled service
A 401 response forces Kerberos authentication
The attacker relays or abuses the obtained service ticket
This technique enables authentication abuse without stealing or cracking passwords.
Impact and attack capabilities
Observed and validated attack outcomes include:
Kerberos relay leading to privilege escalation
Cross-protocol relay attacks such as HTTP to SMB or HTTP to LDAP
Lateral movement within the domain
User impersonation without credential compromise
Remote code execution in environments exposing AD CS Web Enrollment (ESC8)
Testing confirms that default configurations on Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 are affected when protections are not explicitly enforced.
Microsoft response and limitations
The issue was responsibly disclosed to Microsoft in October 2025.
In January 2026 security updates, Microsoft introduced Channel Binding Token (CBT) support for HTTP.sys, tracked as CVE-2026-20929.
This mitigation reduces exposure for HTTP-based relay attacks. However, it does not address the underlying DNS CNAME coercion mechanism. Other Kerberos-enabled protocols remain exposed if signing and binding protections are not enforced.
Proof of concept
Researchers released a modified version of the MITM6 tool with support for targeted DNS CNAME poisoning.
The PoC demonstrates:
Selective or broad CNAME poisoning
Compatibility with ARP-based attacks
Exploitation using standard Kerberos authentication flows
The tool requires a Linux environment and Python 3.x.
Defensive considerations
This research reinforces a critical operational reality. Kerberos does not inherently prevent relay attacks. Protection depends on service-level controls.
Effective mitigation requires:
Enforcing SMB signing on all servers
Requiring LDAP signing and enabling LDAPS with CBT where supported
Mandating HTTPS with CBT for internal web services
Hardening DNS infrastructure and reducing spoofing opportunities
Monitoring for anomalous Kerberos TGS requests targeting unusual SPNs
Detecting cross-protocol authentication patterns
Disabling NTLM alone is not sufficient.
The DIAMATIX Perspective
This technique highlights a recurring identity security pattern. Mitigations reduce known paths, but attackers adapt by abusing trust boundaries between protocols.
DNS remains a frequent blind spot. Identity attacks increasingly rely on coercion rather than credential theft.
Security teams should treat Kerberos abuse as an operational detection problem, not only a configuration issue.
DNS-based Kerberos relay demonstrates how legacy assumptions in identity infrastructure continue to be abused in modern environments.
Long-term resilience depends on enforcing protocol protections consistently and maintaining visibility into authentication behavior across the domain.
Trusted · Innovative · Vigilant
Sources
Independent security research on Kerberos relay and DNS CNAME abuse
Public disclosures related to CVE-2026-20929
Microsoft Windows January 2026 security updates
Analysis of Active Directory Certificate Services relay techniques
Open-source tooling and proof-of-concept research
