For decades, DNS had a peculiar query type: QTYPE=ANY (value 255). It was meant to be a debugging convenience — ask a resolver for "everything you have cached about this name" and get back a mixed bag of A, AAAA, MX, TXT, NS, and whatever else was lying around. It was never a reliable enumeration mechanism (caches only return what they happen to have), but dig google.com any became muscle memory for a generation of engineers.

Then the internet got mean.

The problem: amplification attacks. DNS is UDP-based, spoofable, and asymmetric — a small query can produce a huge response. ANY queries are the worst offender: a 40-byte question can yield kilobytes of answer. Attackers spoof the victim's source IP, blast ANY queries at open resolvers, and the resolvers unwittingly flood the victim. Throughout the 2010s, DNS ANY reflection became a favored DDoS technique, with amplification factors north of 50x when DNSSEC signatures were included.

Cloudflare's unilateral fix. In 2015, Cloudflare's authoritative servers started responding to ANY queries with a single synthetic record: an HINFO RRset with values like "RFC8482" and "". They picked HINFO — the ancient, essentially unused "Host Information" record from RFC 1035 — precisely because nobody uses it, so hijacking it wouldn't collide with anyone's real data. The response is tiny, the amplification factor drops to nearly 1, and the attack dies.

This was controversial. Cloudflare was unilaterally breaking a documented query type. Debugging tools broke. Purists howled. But the attacks stopped.

RFC 8482 blesses the hack. Four years later, this RFC formalizes what was already de-facto standard practice. It explicitly permits authoritative servers to return any one of:

• A single synthetic HINFO record (Cloudflare's choice)
• A subset of the actual RRsets available
• A single RRset chosen by the server

Critically, the RFC acknowledges the tradeoff head-on: ANY was never a reliable enumeration tool anyway, and the operational benefit of neutering amplification vastly outweighs the loss of a debugging convenience. It also nudges the ecosystem toward using multiple targeted queries (A, AAAA, MX) instead.

Design decisions worth noting:

• No wire-format changes. The response is a valid DNS answer. Old resolvers don't crash; they just get less data than they expected.
• Server discretion. The RFC doesn't mandate which minimal response to send — implementations are free to pick. This preserved Cloudflare's existing behavior while allowing Knot, BIND, and others to make their own calls.
• The HINFO string "RFC8482" is a self-documenting hint: engineers who tcpdump the response can Google the string and immediately understand what happened.

Why it matters today. Every time you run dig +short any cloudflare.com and get back "RFC8482" "", you're seeing this in action. More broadly, RFC 8482 is a case study in how the IETF now works: sometimes a large operator ships a pragmatic hack, it demonstrably works for years, and the standards process catches up and legitimizes it. Compare to the old world where the RFC came first. It also illustrates a durable pattern in security engineering — the cheapest DDoS mitigations are often the ones that remove the attacker's leverage rather than absorb the traffic.