This affects 2008 and newer, older versions did not support DNAME[1] records. It isn't clear whether an existing DNAME record needs to exist in order for this to be exploitable. Skimming the Sonar FDNS[2] dataset, only 5,581 DNAME records were identified[3]. A diff has been posted by Greg Linares[4], showing the addition of a memset(0) to the DNAME merge function.

1. https://tools.ietf.org/html/rfc6672 2. https://scans.io/study/sonar.fdns 3. https://hdm.io/data/20151121_dname.txt.gz 4. https://twitter.com/Laughing_Mantis/status/67430845437942579...