Skip to main content
daily-triage/split-horizon-dns-answers-diverge-after-a-failed-zone-transfer.md
Daily Triage Briefing

Split-Horizon DNS Answers Diverge After a Failed Zone Transfer

Impact Summary

A fictional Networking & DNS triage exercise in which a secondary DNS server keeps serving a stale zone after a silent AXFR failure, producing conflicting answers for internal clients.

SeveritySEV-3
StatusResolved simulation
PlatformNetworking & DNS
Incident TypeNetworking & DNS
Published8 Aug 2026
Technologies Involved
DNS

Simulation Label

Fictional simulation. This exercise is a bounded, invented training scenario for practising operational reasoning. No real organisation, incident, telemetry, credentials or production identifiers are involved or implied.

Operational Summary

Root Cause

A TSIG key rotation on the primary DNS server was not mirrored to the secondary, causing AXFR zone transfers to fail silently; the secondary continued serving a stale zone version, producing split-brain DNS answers for a subset of internal clients.

Detection Method

Evidence-led guided investigation

Current Status

Resolved simulation

Affected Services

DNS

Incident Overview

Fictional company Meridian Retail Group runs an internal service at api.internal.corp, authoritative on primary name server ns1.internal.corp (10.0.4.10) with secondary ns2.internal.corp (10.0.4.11). After migrating the backend to a new address, the platform team updated the primary zone.

Within an hour, some app servers connect successfully while others intermittently receive HTTP 502 errors from a backend that no longer exists.

Investigation Options

Review the available operational moves and select the best immediate action.

A

Restart the affected application servers to clear cached connections and stateful sessions blamed for the 502 errors.

B

Correct the TSIG key mismatch on the secondary name server, then force a fresh AXFR zone transfer and confirm SOA serial parity across all authoritative servers.

C

Manually edit the zone file directly on the secondary name server to insert the new record while the transfer failure is investigated.

D

Reduce the DNS TTL on the affected record globally to accelerate propagation across all resolvers.

Tags:DNS