Page 131 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
EDNS uses an OPT pseudo-record to carry the sender’s UDP payload size plus extended response-code, version, flag, and option fields. A requestor advertises the maximum UDP payload it can reassemble in the OPT CLASS field, and responders must limit replies to that advertised size.
Read the guide
Authoritative secondary servers must be geographically dispersed and connected through diverse network paths so one failure cannot isolate all servers. Placing every authoritative server on one LAN, in one room, or in one building defeats most of the resilience gained from multiple servers.
Read the playbook
The generic master-file form for an unknown RR type uses a type code and a length-prefixed hexadecimal representation of its RDATA. DNS servers and resolvers must handle unknown RR types transparently without requiring type-specific RDATA knowledge.
Read the briefing
An AAAA record stores one 128-bit IPv6 address in network byte order for its owner name. An AAAA query returns the IPv6 address records associated with the queried name; it does not perform reverse mapping.
Read the checklist
A server must not merge response records with cached records to construct one RRset; it retains one complete set and ignores or replaces the other. Primary-zone and transferred-zone data rank above authoritative answer data, which ranks above non-authoritative answers and additional information.
Read the explainer
Client and server protocol behavior should not change merely because of the other endpoint’s domain name. When a protocol offers capability negotiation, endpoints should negotiate supported features instead of inferring them from a domain name.
Read the guide
For an existing name that has no AAAA record, an authoritative server should return NOERROR with an empty answer rather than NXDOMAIN. Returning NXDOMAIN to an AAAA query incorrectly asserts that the queried name does not exist, not merely that its AAAA record is absent.
Read the playbook
A resolver requests server identification by sending an empty NSID option in an EDNS OPT record; request payload data is not allowed. An NSID request identifies only the server that directly receives it, so a recursive server does not transitively forward the client’s request semantics.
Read the briefing
A simple gateway DNS proxy should forward the complete request and response verbatim so new extensions behave as if the proxy were absent. A proxy must pass packets with unknown DNS flags, record types, classes, or uncompressed labels instead of rejecting them.
Read the checklist
A special-use name requires an IETF Standards Action or IESG Approval specification that defines how implementations recognize the affected names.
Read the explainer