mDNS
Multicast DNSmDNS is name resolution without a name server. A device that wants to find printer.local simply asks the whole local link over multicast, and the machine that owns the name answers for itself — which is how a printer or a speaker appears the moment you plug it in.
mDNS resolves .local names by asking the whole segment — no server, no configuration, no administrator.
How it works
Answers are multicast rather than unicast so that every listener learns from someone else’s question. Records carry a TTL and are announced again as they expire — and a departing device sends a goodbye with TTL 0.
What mDNS does, step by step
On joining, a device probes for its desired .local name three times; silence means it may take it.
It multicasts its records so everyone on the link can cache the name and address together.
When a query for its name arrives on the group address, only the owner responds — to the group.
DNS-SD adds PTR, SRV and TXT records so clients can ask “what printers are here?” rather than for a name.
In cybersecurity
mDNS trusts anyone on the same segment to answer for any name — convenient at home, and a ready-made spoofing and reconnaissance channel anywhere else.
Nothing stops a host answering for printer.local — the fastest reply wins.
Listening to the group address alone maps every device, its name and its services.
Laptops announce names like “anna-macbook” to any network they join, including public Wi-Fi.
Exposed 5353 on a WAN interface has been used to amplify DDoS — it should never be reachable.
Blocking multicast between client ports stops discovery being used to browse other tenants.
On servers and in datacentres there is rarely a reason for it to be running at all.