Page 126 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Every secure dynamic update carries TSIG or SIG(0) authentication so the primary server can identify the update principal. A TKEY-derived shared secret established without authentication must not be used to authorize secure dynamic updates.
Read the checklist
An AXFR response that transfers a zone consists of one or more DNS messages carrying the zone’s contents. The AXFR message series begins and ends with the same zone SOA; non-SOA records may otherwise arrive in any order or grouping.
Read the explainer
NXDOMAIN means the queried name does not exist, while NODATA is a successful response showing that the existing name lacks the requested record type. An authoritative NXDOMAIN or NODATA response must include the zone’s SOA record in the authority section.
Read the guide
An iterative resolver must not ask a parent server for the NS RRset of a zone whose listed servers are all nonresponsive. A resolver that caches lame servers must key each entry by zone name, class, and server IP address and suppress queries for a configurable interval.
Read the playbook
IDNA2008 assigns each Unicode code point one derived property: PVALID, CONTEXTJ, CONTEXTO, DISALLOWED, or UNASSIGNED. The property derivation applies the category rules in order, and the first matching rule determines the code point’s property.
Read the briefing
ASCII letters in DNS names are compared case-insensitively throughout the DNS protocol. DNS implementations should preserve the original case of names when possible even though protocol comparisons ignore ASCII case.
Read the checklist
A TKEY record carries the key algorithm, inception and expiration times, exchange mode, error, key data, and optional other data. A TKEY query places its TKEY record in the additional-information section and uses the mode field to select the key-agreement procedure.
Read the explainer
GSS-TSIG uses a TKEY exchange to establish a GSS security context and then uses the derived context key with TSIG. The client repeats GSS_Init_sec_context token exchanges in TKEY queries until the security context is complete or an error occurs.
Read the guide
A server-instance identification mechanism should work in-band with normal DNS queries and also permit a dedicated identification query. The identifier should distinguish a server instance without forcing disclosure of a private hostname or administrative unicast address.
Read the playbook
The top-level names .test, .example, .invalid, and .localhost are reserved for their designated testing, documentation, invalid-name, and loopback uses. The second-level names example.com, example.net, and example.org are reserved for examples.
Read the briefing