Safety
X-DNS-Prefetch-Control vs Referrer-Policy for URL Leaks
June 21, 2023
X-DNS-Prefetch-Control vs Referrer-Policy is two different gossip networks. Referrer-Policy limits what the next site sees in the Referer header — path, query, origin, or nothing. X-DNS-Prefetch-Control (and <link rel=dns-prefetch>) decides whether the browser may resolve hostnames it has not navigated to yet, which can tell a recursive resolver that your page mentioned cdn.example.net. They do not replace each other. Public marketing sites should set Referrer-Policy (often strict-origin-when-cross-origin) on HTML. Turning prefetch off is optional hygiene, especially on pages that mention sensitive internal hostnames. RoastMyOpsec grades Referrer-Policy on the primary document response. It does not score prefetch-control today.
The practical difference
Referrer is a hop-to-hop HTTP header. Tokens in query strings ride along unless you clamp the policy — see open redirects vs tokens in URLs. Prefetch is a DNS side channel: the browser looks up names early for speed. Corporate resolvers and some networks log those lookups.
Most brochure pages prefetch public CDNs on purpose. The OPSEC miss is prefetching staging.internal or a hostname that is not meant to be guessed from a public HTML comment.
How to choose based on the page
Ship Referrer-Policy on every HTML document this week. Keep tokens out of URLs. Use dns-prefetch only for origins you already load as first- or third-party assets. Set X-DNS-Prefetch-Control: off if the page is an authenticated app shell that should not hint extra names — test performance, then decide.
| Control | Who learns what | Typical marketing default | Takeaway |
|---|---|---|---|
| Referrer-Policy | The next website | strict-origin-when-cross-origin | Do this; see the Referrer guide |
| X-DNS-Prefetch-Control: off | Resolvers see fewer speculative names | Often unset (browser default on) | Useful on sensitive app HTML |
| link rel=dns-prefetch | Resolver sees that hostname early | Fonts and tag managers | Only for hosts you already trust in CSP |
| HSTS / HTTPS | Transport, not these leaks | Required anyway | Different layer |
What a header roast will not claim
A missing prefetch-control header is not an F. A missing Referrer-Policy still is a no-brainer on the free checklist. Prefetch does not fix mixed content or clickjacking.
Common mistakes
The first mistake is prefetch-control: off as a substitute for Referrer-Policy.
The second mistake is dns-prefetch to a hostname that only exists on the corp VPN.
The third mistake is tokens in URLs plus a loose referrer policy.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is DNS prefetch a vulnerability?
- It is a privacy and inventory hint, not a bypass. Clamp it on sensitive pages. Fix Referrer-Policy and URL tokens either way.
- Does RoastMyOpsec check X-DNS-Prefetch-Control?
- The free header pack grades Referrer-Policy, not prefetch-control. Confirm prefetch at the CDN if you rely on it.
- Will turning prefetch off break my site?
- It can add a little latency on first hops to third-party hosts. It should not break rendering. Test, then keep Referrer-Policy regardless.