Page 128 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
A simple gateway DNS proxy should forward the complete request and response verbatim so new extensions behave as if the proxy were absent. A proxy must pass packets with unknown DNS flags, record types, classes, or uncompressed labels instead of rejecting them.
Read the checklist
A special-use name requires an IETF Standards Action or IESG Approval specification that defines how implementations recognize the affected names.
Read the explainer
A DHCP updater associates an FQDN with one client’s identity by adding a DHCID record alongside the client’s A, AAAA, or PTR records. If the FQDN exists, the updater requires a matching DHCID record before replacing address records for the same client.
Read the guide
Before claiming a unique link-local record, an mDNS responder sends three probes and treats any live answer with that name as a conflict. Simultaneous probes compare proposed records, and the lexicographically later record wins the tiebreak.
Read the playbook
Punycode is a Bootstring encoding that represents a sequence from a large code-point set using only a smaller basic code-point set. The encoder and decoder must detect arithmetic overflow or enforce equivalent input limits; invalid input is not assumed to fit IDNA label bounds.
Read the briefing
DNS-SD enumeration queries a service-type name for PTR records whose targets are the available service-instance names. After choosing an instance, a client queries that instance name for SRV and TXT records; SRV supplies target host and port, while TXT supplies service metadata.
Read the checklist
Unless configured otherwise, a resolver serves the designated reverse zones locally and returns authoritative name errors for names below each zone. Implementations must allow local serving to be disabled and should support enabling or disabling it one zone at a time.
Read the explainer
After an expired DNS record cannot be refreshed authoritatively, a recursive resolver may temporarily use the record as though it were unexpired. A stale response must assign each expired record a positive TTL; the recommended response TTL is 30 seconds.
Read the guide
IDNA-aware applications recognize three valid label categories: A-labels, U-labels, and non-reserved LDH labels. An A-label is the ASCII-compatible form of a complete IDNA label, begins with xn--, and must decode to a valid U-label.
Read the playbook
A DNS client should base retries on server round-trip estimates, cycle among servers, and increase retry timeouts exponentially. Resolvers should cap the referral and CNAME chains they follow and avoid self-referring servers so malformed data cannot create recursion loops.
Read the briefing