Page 213 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
A TKEY record carries the key algorithm, inception and expiration times, exchange mode, error, key data, and optional other data. A TKEY query places its TKEY record in the additional-information section and uses the mode field to select the key-agreement procedure.
Read the explainer
GSS-TSIG uses a TKEY exchange to establish a GSS security context and then uses the derived context key with TSIG. The client repeats GSS_Init_sec_context token exchanges in TKEY queries until the security context is complete or an error occurs.
Read the guide
A server-instance identification mechanism should work in-band with normal DNS queries and also permit a dedicated identification query. The identifier should distinguish a server instance without forcing disclosure of a private hostname or administrative unicast address.
Read the playbook
The top-level names .test, .example, .invalid, and .localhost are reserved for their designated testing, documentation, invalid-name, and loopback uses. The second-level names example.com, example.net, and example.org are reserved for examples.
Read the briefing
TSIG can authenticate a dynamic-update client to a server, but it protects the transaction rather than the updated zone data seen by resolvers.
Read the checklist
Before accepting a DNS reply, a resolver must match its addresses, destination port, query ID, query name, query class, and query type to the outstanding query.
Read the explainer
EDNS uses an OPT pseudo-record to carry the sender’s UDP payload size plus extended response-code, version, flag, and option fields. A requestor advertises the maximum UDP payload it can reassemble in the OPT CLASS field, and responders must limit replies to that advertised size.
Read the guide
Authoritative secondary servers must be geographically dispersed and connected through diverse network paths so one failure cannot isolate all servers. Placing every authoritative server on one LAN, in one room, or in one building defeats most of the resilience gained from multiple servers.
Read the playbook
The generic master-file form for an unknown RR type uses a type code and a length-prefixed hexadecimal representation of its RDATA. DNS servers and resolvers must handle unknown RR types transparently without requiring type-specific RDATA knowledge.
Read the briefing
An AAAA record stores one 128-bit IPv6 address in network byte order for its owner name. An AAAA query returns the IPv6 address records associated with the queried name; it does not perform reverse mapping.
Read the checklist