How Fritz!Box Routers Affect DDEV DNS Resolution — and How to Fix It

The post clarifies how DNS rebinding attacks work and why Fritz!Box routers enforce such strict protections. Although the mechanism is useful for blocking malicious attempts to redirect DNS responses into a user’s local network, it unintentionally impacts legitimate workflows like DDEV’s local-only routing. Fay emphasises that DDEV’s networking model is safe: users explicitly configure it, its services only bind to 127.0.0.1, and its behavior is transparent. However, because the router cannot distinguish this from an attack pattern, an explicit exception for ddev.site is required.

Fay provides a clear solution: add ddev.site to the Fritz!Box DNS Rebinding Protection exception list via the router’s network settings. This restores DDEV’s intended DNS functionality without relying on fallback hosts file modifications. Alternatives include using a different DNS provider such as Cloudflare’s 1.1.1.1 or enabling the hosts file workaround, though the router-level fix is recommended. The article closes with additional documentation links and acknowledgments to contributors who helped identify and document the issue.