Page 215 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Unless configured otherwise, a resolver serves the designated reverse zones locally and returns authoritative name errors for names below each zone. Implementations must allow local serving to be disabled and should support enabling or disabling it one zone at a time.
Read the explainer
After an expired DNS record cannot be refreshed authoritatively, a recursive resolver may temporarily use the record as though it were unexpired. A stale response must assign each expired record a positive TTL; the recommended response TTL is 30 seconds.
Read the guide
IDNA-aware applications recognize three valid label categories: A-labels, U-labels, and non-reserved LDH labels. An A-label is the ASCII-compatible form of a complete IDNA label, begins with xn--, and must decode to a valid U-label.
Read the playbook
A DNS client should base retries on server round-trip estimates, cycle among servers, and increase retry timeouts exponentially. Resolvers should cap the referral and CNAME chains they follow and avoid self-referring servers so malformed data cannot create recursion loops.
Read the briefing
By default, DNS64 must not synthesize AAAA records when usable, non-excluded AAAA records already exist. After an empty AAAA answer, DNS64 queries for A records and synthesizes AAAA records only when one or more A records are returned.
Read the checklist
Wildcard synthesis is considered only after label matching finds neither an exact name nor a delegation referral. The sole synthesis source is the wildcard name immediately below the closest existing encloser; the closest encloser itself is not the source.
Read the explainer
An SOA NOTIFY makes a secondary perform a refresh check against the notifying master; transfer follows only if the SOA serial increased. Data in a NOTIFY answer is only a hint and must never directly update the secondary, force a transfer, or change refresh timers.
Read the guide
DHCID record data binds DHCP client-identification material to the requested fully qualified domain name through a SHA-256-based digest. An updater recomputes the client identity for the requested name and compares it with any DHCID records already stored at that name.
Read the playbook
An IXFR request carries the SOA serial of the client’s current zone copy so the server can anchor an incremental response.
Read the briefing
The convention assigns familiar aliases such as mail, ftp, and www to common network services within an organization’s domain. A service alias is only a discovery hint; its existence does not prove that the service resolves, listens on a conventional port, or accepts a client’s request.
Read the checklist