The bailiwick rule is not built into the DNS protocol itself and is not present within an authoritative DNS server instead the bailiwick logic resides within recursive name servers only. The bailiwick rule states that a recursive DNS server will not accept responses from an authoritative DNS that fall outside the scope of authority (bailiwick) of the authoritative server. Now, anyone using that recursive server and attempting to visit Google’s web site would wind up going to a server owned by the attacker, even though everything would look correct from a DNS perspective. This is an unprompted request, but recursive servers accepted anything that was sent to them, so most of them would cache it. The authoritative servers respond with an answer, as shown in the code above, but they also add additional domain mappings. When users visited that bad domain their recursive DNS server queried the authoritative name servers for the bad domain.

To do so an attacker would set up a bad domain on authoritative name servers that she controls. Up until the bailiwick rule was implemented in 1993 it was relatively trivial to poison a DNS cache.

The recursive DNS server asks for the A record, it also asks for the MX record and stores it in its cache so if other users of this recursive DNS server need that information it will already be available, at least until the Time to Live (TTL) expires. This is a part of what the recursive DNS server sees: To understand how this attack would work, take a look at a traditional DNS request from the user perspective and the DNS recursive server perspective. Fortunately, this type of cache poisoning attack is no longer effective. The simplest form of this attack is to send additional A records with a request to a malicious domain. That data usually involves passing an incorrect A record to the recursive server in order to redirect traffic to infrastructure owned by the attacker. In a DNS cache poisoning attack an attacker takes advantage of flaws in the DNS protocol to load bad data into a recursive DNS server. Allan Liska, Geoffrey Stowe, in DNS Security, 2016 Cache Poisoning

Hack router port 53 udp