Page 216 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
A primary processes the UPDATE prerequisite section against the zone’s current state before it applies any additions or deletions. Prerequisites can assert that a name or RRset exists, does not exist, or exactly equals a supplied RRset, with a defined failure response for each condition.
Read the explainer
IDNA registration and lookup are separate procedures with similar but nonidentical validation steps. Registration validates the complete label under the permitted-code-point, contextual, normalization, hyphen, combining-mark, and bidirectional rules before creating an A-label.
Read the guide
A server validates a received Server Cookie against the Client Cookie, client IP address, and its current or recent secret before treating the request as previously seen. Only a valid Server Cookie lets the server omit defensive measures intended for spoofed UDP requests.
Read the playbook
Internationalized mail permits UTF-8 in header field bodies, while header field names remain ASCII-only. UTF-8 header text should use NFC normalization and should not use NFKC when that would lose spelling distinctions.
Read the briefing
An SMTP TLS aggregate report is I-JSON containing report metadata, applied policy, aggregate session counts, and optional per-failure details. A report should cover one UTC day, and senders should delay delivery to avoid overloading the report processor.
Read the checklist
One JMAP API request carries an ordered array of method calls, which the server processes sequentially and answers with an ordered response array.
Read the explainer
A DNSSEC-secure TLSA RRset with at least one usable record requires both TLS encryption and SMTP server authentication. If all records in a secure nonempty TLSA RRset are unusable, TLS remains mandatory but authentication is not; lookup errors defer delivery or try another MX.
Read the guide
Sieve tests are arguments to conditional commands and select which action block executes for a message. The base language supports keep, fileinto, redirect, and discard, while implementations may bound action counts and restrict incompatible combinations.
Read the playbook
Encoded-words are allowed only in specified text fields, comments, and phrase words; they are forbidden in addr-specs, quoted strings, Received fields, and MIME parameters.
Read the briefing
A mail client uses the domain part of the user’s address to query service-specific SRV names and obtains the selected endpoint’s target host and port.
Read the checklist