Page 214 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
A server must not merge response records with cached records to construct one RRset; it retains one complete set and ignores or replaces the other. Primary-zone and transferred-zone data rank above authoritative answer data, which ranks above non-authoritative answers and additional information.
Read the explainer
Client and server protocol behavior should not change merely because of the other endpoint’s domain name. When a protocol offers capability negotiation, endpoints should negotiate supported features instead of inferring them from a domain name.
Read the guide
For an existing name that has no AAAA record, an authoritative server should return NOERROR with an empty answer rather than NXDOMAIN. Returning NXDOMAIN to an AAAA query incorrectly asserts that the queried name does not exist, not merely that its AAAA record is absent.
Read the playbook
A resolver requests server identification by sending an empty NSID option in an EDNS OPT record; request payload data is not allowed. An NSID request identifies only the server that directly receives it, so a recursive server does not transitively forward the client’s request semantics.
Read the briefing
A simple gateway DNS proxy should forward the complete request and response verbatim so new extensions behave as if the proxy were absent. A proxy must pass packets with unknown DNS flags, record types, classes, or uncompressed labels instead of rejecting them.
Read the checklist
A special-use name requires an IETF Standards Action or IESG Approval specification that defines how implementations recognize the affected names.
Read the explainer
A DHCP updater associates an FQDN with one client’s identity by adding a DHCID record alongside the client’s A, AAAA, or PTR records. If the FQDN exists, the updater requires a matching DHCID record before replacing address records for the same client.
Read the guide
Before claiming a unique link-local record, an mDNS responder sends three probes and treats any live answer with that name as a conflict. Simultaneous probes compare proposed records, and the lexicographically later record wins the tiebreak.
Read the playbook
Punycode is a Bootstring encoding that represents a sequence from a large code-point set using only a smaller basic code-point set. The encoder and decoder must detect arithmetic overflow or enforce equivalent input limits; invalid input is not assumed to fit IDNA label bounds.
Read the briefing
DNS-SD enumeration queries a service-type name for PTR records whose targets are the available service-instance names. After choosing an instance, a client queries that instance name for SRV and TXT records; SRV supplies target host and port, while TXT supplies service metadata.
Read the checklist