A DFS referral is a message in Windows Distributed File System that tells a client where to go next to reach a shared path. Instead of exposing the real file server directly, a DFS namespace can return a referral that points the client to the correct target, such as another server or share.
DFS referrals matter because they sit on a trusted redirection path inside common Windows file-sharing traffic. If a referral is malformed, spoofed, or parsed unsafely, it can break access, misdirect users, or trigger crashes in the server that processes it. Attackers may abuse referral handling in availability attacks or use it to move traffic toward an unexpected destination. Defenders should treat DFS as security-relevant infrastructure: patch referral-processing bugs, inventory namespace servers, and monitor SMB/SMB2 activity for unusual referral behavior.