If an attacker is attempting to use the Kaminsky method of DNS cache poisoning, what is the maximum number of unique Query IDs which must be presented to the victim DNS server before a match is made?

32,768 represents half of the theoretical 16-bit Query ID space and does not correspond to the specific reduced-entropy limitation that the Kaminsky attack targeted in vulnerable implementations.

4,096 (2^12) does not reflect the 10-bit transaction ID constraint exploited by the Kaminsky method and has no defined role in the attack's mathematics.

65,536 is the full 16-bit Query ID space; if implementations properly randomized all 16 bits, the Kaminsky attack would be computationally impractical within the DNS response window.

Several DNS server implementations at the time of Kaminsky's 2008 disclosure used only 10 bits of effective transaction ID entropy rather than the full 16 bits, capping the search space at 1024 unique Query IDs. By querying randomly generated subdomains in rapid succession and flooding each with forged responses covering all possible IDs in that reduced space, an attacker could reliably poison the cache before the legitimate response arrived. Kaminsky's key insight was combining subdomain randomization with high-volume forgery to make the attack practical against this limited entropy.