DSE security knowledge hub

Networks & Infrastructure
Knowledge

Page 133 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.

DSE-authoredOfficial sourcesReviewed guidance
Search the library
Explore this topic

Networks & Infrastructure knowledge center

Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.

Start with the cornerstone guide
DSE post stream

Networks & Infrastructure

1,594 articles
DSE visual briefNetworks & infrastructure

Trigger secondary refresh checks with NOTIFY without treating notice as transfer

An SOA NOTIFY makes a secondary perform a refresh check against the notifying master; transfer follows only if the SOA serial increased. Data in a NOTIFY answer is only a hint and must never directly update the secondary, force a transfer, or change refresh timers.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the guide
DSE visual briefNetworks & infrastructure

Use DHCID data to identify competing DHCP ownership claims

DHCID record data binds DHCP client-identification material to the requested fully qualified domain name through a SHA-256-based digest. An updater recomputes the client identity for the requested name and compares it with any DHCID records already stored at that name.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the playbook
DSE visual briefNetworks & infrastructure

Use service-facing DNS aliases without treating aliases as service discovery

The convention assigns familiar aliases such as mail, ftp, and www to common network services within an organization’s domain. A service alias is only a discovery hint; its existence does not prove that the service resolves, listens on a conventional port, or accepts a client’s request.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the checklist
DSE visual briefNetworks & infrastructure

Validate DNS UPDATE prerequisites before applying zone additions or deletions

A primary processes the UPDATE prerequisite section against the zone’s current state before it applies any additions or deletions. Prerequisites can assert that a name or RRset exists, does not exist, or exactly equals a supplied RRset, with a defined failure response for each condition.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the explainer
DSE visual briefNetworks & infrastructure

Validate IDNA registration and lookup as separate processing paths

IDNA registration and lookup are separate procedures with similar but nonidentical validation steps. Registration validates the complete label under the permitted-code-point, contextual, normalization, hyphen, combining-mark, and bidirectional rules before creating an A-label.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the guide
DSE visual briefNetworks & infrastructure

Verify DNS Cookies before granting the server-cookie trust benefit

A server validates a received Server Cookie against the Client Cookie, client IP address, and its current or recent secret before treating the request as previously seen. Only a valid Server Cookie lets the server omit defensive measures intended for spoofed UDP requests.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the playbook
DSE visual briefNetworks & infrastructure

Aggregate SMTP TLS policy outcomes into daily JSON reports

An SMTP TLS aggregate report is I-JSON containing report metadata, applied policy, aggregate session counts, and optional per-failure details. A report should cover one UTC day, and senders should delay delivery to avoid overloading the report processor.

Published Reviewed 3 min readBy DSE Security Editorial Team
Read the checklist