Audit DNS serials, MX targets, and delegation glue for common errors

Keep this document to one review outcome: Audit DNS serials, MX targets, and delegation glue for common errors. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official RFC 1912 — Common DNS Operational and Configuration Errors from RFC Editor supports the following bounded statements:

• A zone’s serial must be changed whenever its data changes; otherwise, secondaries will not transfer the new zone data. The research record locates this support at Section 3.1 (Serial numbers).
• Every delegated name server should answer authoritatively for the zone; a delegated server that does not serve the zone creates a lame delegation. The research record locates this support at Section 2.8 (Authority and Delegation Errors).
• The parent and child should publish the same NS set, and address records must be updated at both levels when a secondary changes address. The research record locates this support at Section 2.8 (Authority and Delegation Errors), delegation coordination.

Keep the evidence boundary at these traced claims. They support a review of authoritative zones, delegations, resolvers, caches, record owners, and the clients that consume the resulting answers; they do not support conclusions outside the source’s stated conditions.

What the source does not establish

This RFC evidence supports only the named DNS protocol decision; it does not prove Windows implementation support or a safe production configuration. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that Windows DNS roles, Active Directory-integrated data, forwarding paths, time, routing, firewalls, and registrar or registry state are healthy. Documented options are review inputs, not universal mandates.

Applicability questions

• For source statement 1 at Section 3.1 (Serial numbers), which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at Section 2.8 (Authority and Delegation Errors), which observable configuration, record, or test can confirm applicability here?
• For source statement 3 at Section 2.8 (Authority and Delegation Errors), delegation coordination, which observable configuration, record, or test can confirm applicability here?
• Within authoritative zones, delegations, resolvers, caches, record owners, and the clients that consume the resulting answers, which versions, roles, and configuration states define the review population?
• Could Windows DNS roles, Active Directory-integrated data, forwarding paths, time, routing, firewalls, and registrar or registry state invalidate the test, hide a failure, or change applicability?
• Who owns the decision, and which observation requires stopping, escalation, or rollback?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Anchor the review in the cited section and keep observation separate from interpretation. Record the source location, examined part of authoritative zones, delegations, resolvers, caches, record owners, and the clients that consume the resulting answers, observed and expected states, owner, and reason for deviation.

Do not move from citation to production in one step. Pilot the decision where practical, observe agreed signals, retain a reversal point, and verify Windows DNS roles, Active Directory-integrated data, forwarding paths, time, routing, firewalls, and registrar or registry state. Handle credentials, keys, recovery data, and personal information through approved secure channels.

Verification and evidence

Keep the source locations Section 3.1 (Serial numbers); Section 2.8 (Authority and Delegation Errors); Section 2.8 (Authority and Delegation Errors), delegation coordination adjacent to the sanitized artifacts used for comparison. Prefer zone data, packet captures, query transcripts, delegation checks, resolver configuration, and negative-answer behavior, with enough identity and timing data for an independent recheck.

Retain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes.

Official references

• RFC 1912 — Common DNS Operational and Configuration Errors — RFC Editor