First question: yes, but the checker function should not rely on the DNS cache. If it does, the attack will still exist Second question: not just once. Hashnode checked the DNS record at regular intervals (every 10 minutes) which was prone to DNS Rebinding attack