Page 129 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
By default, DNS64 must not synthesize AAAA records when usable, non-excluded AAAA records already exist. After an empty AAAA answer, DNS64 queries for A records and synthesizes AAAA records only when one or more A records are returned.
Read the checklist
Wildcard synthesis is considered only after label matching finds neither an exact name nor a delegation referral. The sole synthesis source is the wildcard name immediately below the closest existing encloser; the closest encloser itself is not the source.
Read the explainer
An SOA NOTIFY makes a secondary perform a refresh check against the notifying master; transfer follows only if the SOA serial increased. Data in a NOTIFY answer is only a hint and must never directly update the secondary, force a transfer, or change refresh timers.
Read the guide
DHCID record data binds DHCP client-identification material to the requested fully qualified domain name through a SHA-256-based digest. An updater recomputes the client identity for the requested name and compares it with any DHCID records already stored at that name.
Read the playbook
An IXFR request carries the SOA serial of the client’s current zone copy so the server can anchor an incremental response.
Read the briefing
The convention assigns familiar aliases such as mail, ftp, and www to common network services within an organization’s domain. A service alias is only a discovery hint; its existence does not prove that the service resolves, listens on a conventional port, or accepts a client’s request.
Read the checklist
A primary processes the UPDATE prerequisite section against the zone’s current state before it applies any additions or deletions. Prerequisites can assert that a name or RRset exists, does not exist, or exactly equals a supplied RRset, with a defined failure response for each condition.
Read the explainer
IDNA registration and lookup are separate procedures with similar but nonidentical validation steps. Registration validates the complete label under the permitted-code-point, contextual, normalization, hyphen, combining-mark, and bidirectional rules before creating an A-label.
Read the guide
A server validates a received Server Cookie against the Client Cookie, client IP address, and its current or recent secret before treating the request as previously seen. Only a valid Server Cookie lets the server omit defensive measures intended for spoofed UDP requests.
Read the playbook
Internationalized mail permits UTF-8 in header field bodies, while header field names remain ASCII-only. UTF-8 header text should use NFC normalization and should not use NFKC when that would lose spelling distinctions.
Read the briefing