Dns

The TXT record only answered for a trusted source IP. EDNS Client Subnet let us claim to be 127.0.0.1 and the server coughed up the flag.