Page 135 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Windows clients and servers can dynamically register and update their DNS names. The Windows implementation includes secure dynamic update behavior and name-conflict handling.
Read the checklist
Microsoft documents query, response, and update message structures for DNS in Windows environments. DNS messages use a header plus question, answer, authority, and additional sections as applicable.
Read the explainer
Windows uses the Name Resolution Policy Table to apply DNSSEC-related name-resolution policy. NRPT rules can be configured through Group Policy or PowerShell.
Read the guide
Windows DNS Policy query filters can vary server behavior based on a query and the client that sent it. Documented filter criteria include client subnet, transport, IP version, server interface, FQDN, query type, and time of day.
Read the playbook
Windows DNS Policy can load-balance application answers with geo-location awareness. The documented configuration groups IPv4 or IPv6 address space into DNS client subnets used by policy.
Read the briefing
Windows Server supports creating, modifying, and deleting DNS resource records through DNS Manager and PowerShell. The documented record data includes record type, owner name, host address, and other record-specific information.
Read the checklist
Microsoft documents geo-location DNS Policy in a primary-secondary DNS deployment. Secondary servers receive zone changes through AXFR and IXFR in the documented primary-secondary model.
Read the explainer
Windows DNS architecture distinguishes domain names, the domain namespace, resource records, and zones. A DNS zone is the hosted portion of a namespace that contains the records answered by an authoritative server.
Read the guide
Windows DNS Server supports transferring the DNSSEC Key Master role between qualifying authoritative servers. If the current Key Master is offline, Microsoft describes seizing the role as a continuity action; file-backed zones cannot transfer the role.
Read the playbook
Windows Server extends DNS Policy support to Active Directory-integrated zones for split-brain deployments. The documented example selects a zone scope from the server interface on which a query arrives.
Read the briefing