Unintended Revelations and Risks: Understanding Cellular DNS Leakage on the Public Internet
It is shown that an on-path adversary can redirect service-discovery responses once such queries leave the operator's network, which would otherwise be infeasible without the leak, highlighting the need for stricter DNS isolation in cellular networks.