Page 111 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
In the DHCPv4 Client FQDN option, S requests server responsibility for the A-record update, N requests no server updates, and O reports that the server overrode the requested S value. A client requesting server-performed forward updates sets S to 1 and sets O and N to 0 in its Client FQDN option.
Read the guide
A zone’s serial must be changed whenever its data changes; otherwise, secondaries will not transfer the new zone data. Every delegated name server should answer authoritatively for the zone; a delegated server that does not serve the zone creates a lame delegation.
Read the playbook
A SIG(0) request signature is placed at the end of the additional section and covers the DNS request, including its DNS header but excluding UDP/IP headers.
Read the briefing
Every secure dynamic update carries TSIG or SIG(0) authentication so the primary server can identify the update principal. A TKEY-derived shared secret established without authentication must not be used to authorize secure dynamic updates.
Read the checklist
An AXFR response that transfers a zone consists of one or more DNS messages carrying the zone’s contents. The AXFR message series begins and ends with the same zone SOA; non-SOA records may otherwise arrive in any order or grouping.
Read the explainer
NXDOMAIN means the queried name does not exist, while NODATA is a successful response showing that the existing name lacks the requested record type. An authoritative NXDOMAIN or NODATA response must include the zone’s SOA record in the authority section.
Read the guide
An iterative resolver must not ask a parent server for the NS RRset of a zone whose listed servers are all nonresponsive. A resolver that caches lame servers must key each entry by zone name, class, and server IP address and suppress queries for a configurable interval.
Read the playbook
IDNA2008 assigns each Unicode code point one derived property: PVALID, CONTEXTJ, CONTEXTO, DISALLOWED, or UNASSIGNED. The property derivation applies the category rules in order, and the first matching rule determines the code point’s property.
Read the briefing
ASCII letters in DNS names are compared case-insensitively throughout the DNS protocol. DNS implementations should preserve the original case of names when possible even though protocol comparisons ignore ASCII case.
Read the checklist
A TKEY record carries the key algorithm, inception and expiration times, exchange mode, error, key data, and optional other data. A TKEY query places its TKEY record in the additional-information section and uses the mode field to select the key-agreement procedure.
Read the explainer