Page 130 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
NXDOMAIN means the queried name does not exist, while NODATA is a successful response showing that the existing name lacks the requested record type. An authoritative NXDOMAIN or NODATA response must include the zone’s SOA record in the authority section.
Read the guide
An iterative resolver must not ask a parent server for the NS RRset of a zone whose listed servers are all nonresponsive. A resolver that caches lame servers must key each entry by zone name, class, and server IP address and suppress queries for a configurable interval.
Read the playbook
IDNA2008 assigns each Unicode code point one derived property: PVALID, CONTEXTJ, CONTEXTO, DISALLOWED, or UNASSIGNED. The property derivation applies the category rules in order, and the first matching rule determines the code point’s property.
Read the briefing
ASCII letters in DNS names are compared case-insensitively throughout the DNS protocol. DNS implementations should preserve the original case of names when possible even though protocol comparisons ignore ASCII case.
Read the checklist
A TKEY record carries the key algorithm, inception and expiration times, exchange mode, error, key data, and optional other data. A TKEY query places its TKEY record in the additional-information section and uses the mode field to select the key-agreement procedure.
Read the explainer
GSS-TSIG uses a TKEY exchange to establish a GSS security context and then uses the derived context key with TSIG. The client repeats GSS_Init_sec_context token exchanges in TKEY queries until the security context is complete or an error occurs.
Read the guide
A server-instance identification mechanism should work in-band with normal DNS queries and also permit a dedicated identification query. The identifier should distinguish a server instance without forcing disclosure of a private hostname or administrative unicast address.
Read the playbook
The top-level names .test, .example, .invalid, and .localhost are reserved for their designated testing, documentation, invalid-name, and loopback uses. The second-level names example.com, example.net, and example.org are reserved for examples.
Read the briefing
TSIG can authenticate a dynamic-update client to a server, but it protects the transaction rather than the updated zone data seen by resolvers.
Read the checklist
Before accepting a DNS reply, a resolver must match its addresses, destination port, query ID, query name, query class, and query type to the outstanding query.
Read the explainer