ProtocolMature
DNS
Also known as: Domain Name System
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
Technology explained
What is DNS?
The Domain Name System is a distributed naming service that maps domain names to records used by applications and networks. This profile connects the concept to KBY's practical engineering guidance.
Resolvers follow referrals through the DNS hierarchy and cache answers according to their time to live. Authoritative zones publish records such as A, AAAA, CNAME, MX and TXT; delegation, DNSSEC, split-horizon design and cache behaviour strongly affect reliability.
Primary purpose
Translate stable names into service and network information.
Typical environments
InternetEnterprise Networks
Typical use cases
- Resolving domain names to IP addresses
- Service discovery
- Email routing (MX records)
Connected knowledge
23+ resources for DNS
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Technology journey
Learn and operate with DNS
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Systems Engineering(3)
Learn the architecture, concepts and engineering context.
- Fixing gRPC Load Balancing Behind L4 ProxiesWhy HTTP/2 multiplexing pins gRPC traffic to single backends behind L4 proxies, and how DNS resolvers, round_robin policy, and Envoy EDS fix it. Open
- Detecting DNS Tunnelling via Resolver EntropyHow Shannon entropy scoring, dnstap capture, and PowerDNS Lua hooks catch DNS tunnelling exfiltration that firewall egress rules miss entirely. Open
- Preventing DNS Split-Brain in Hybrid Azure/ADA technical guide to eliminating DNS split-brain in hybrid Azure/AD environments using NRPT, GPO policy and Azure Private DNS Resolver architecture. Open
Graduate Learning(2)
Build practical knowledge and hands-on skills.
Daily Triage(1)
Practise diagnosis through bounded engineering scenarios.
Config Traps(12+)
Recognise and avoid known failure modes.
- A Fourth SPF Include Record Silently Breaks DMARC Alignment for All SendersA routine SPF include addition silently breaks DMARC alignment once total DNS mechanism lookups exceed the evaluator ceiling, with no DNS-side error to flag it. Open
- Apex-Only CAA Leaves CNAMEd Subdomains Open to Unauthorized IssuanceCAA records at a domain's apex look protective in every audit, but a subdomain CNAMEd to a shared zone is checked against that zone's CAA policy instead, silently exposing it to unapproved certification authorities. Open
- Healthy Secondary DNS Still Leaves a Single Point of FailureWhy a fully synchronised, healthy secondary DNS server can still leave a domain with a single point of failure - and how to prove, verify and safely reverse the fix. Open
- Legacy AXFR Flags Survive Windows DNS UpgradesAn in-place upgraded Windows DNS Server can retain a zone-level TransferAnyServer flag from a decommissioned Windows Server 2008 secondary, letting any host on the internal network pull a full AXFR of the AD-integrated zone. Firewall rules and Kerberos authentication never see the query, because zone transfer authorisation is checked entirely inside the DNS service. Open
- Default-Deny Egress Silently Breaks Pod DNS LookupsA cluster-wide egress default-deny NetworkPolicy blocks UDP/TCP 53 to CoreDNS unless an explicit allow rule exists, and the resulting failures surface as connection timeouts and retry storms in application logs rather than obvious DNS errors, sending on-call engineers chasing the wrong service. Open
- Split-Horizon DNS: When Internal Zones Leak OutA single authoritative DNS server configured to serve both internal and external views can answer public queries with RFC1918 records, exposing internal hostnames, subnet layout and service topology to anyone running dig against the public nameserver, with no firewall or WAF positioned to catch it. Open
- BIND9 Secondaries Inherit the Open AXFR DefaultA hardened AXFR policy on the primary nameserver means nothing if the secondaries never got the same allow-transfer ACL. BIND9 falls back to its global any default per zone stanza, so attackers query the slave directly and pull the full zone, exposing every internal hostname without touching the locked-down primary at all. Open
- High DNS TTL on Failover Records Stalls DR CutoverA failover CNAME or A record carries the zone's default TTL of an hour or more, so when disaster recovery routing flips at the authoritative nameserver, cached answers on recursive resolvers, container stub resolvers, and ISP infrastructure keep pointing clients at the dead primary for the full TTL window, regardless of how fast the health check reacts. Open
- CNAME Chains That Outlive the SaaS Account Behind ThemA CNAME chain provisioned for a SaaS custom domain can keep resolving through a vendor's shared edge network long after the underlying account is deleted, because the intermediate hop stays alive and only the final hostname claim expires. Standard dangling-DNS scanners check for NXDOMAIN or dead IPs, miss this state entirely, and never flag the exposure until an attacker claims the same hostname on the same platform. Open
- Wildcard Records Pinned to Dead Load Balancer IPsA wildcard A record bound directly to a load balancer's raw IP survives the load balancer's deletion, and the released IP re-enters the cloud provider's allocation pool within hours. Every unregistered subdomain under that wildcard then resolves to whichever tenant receives the IP next, and no existing takeover scanner flags it because the record was never dangling on a CNAME. Open
- AD-Integrated DNS Zones Still Allow Open TransfersA Windows DNS Server zone left on "Allow zone transfers: To any server" hands out every SRV and host record for a domain controller via a single unauthenticated AXFR query. Active Directory replication does not govern this setting, and standard DC firewall rules and event logging rarely flag the transfer at all. Open
- SPF's +all Catch-All Turns Includes Into Open TrustA hand-edited SPF record with a permissive +all catch-all or an unscoped third-party include mechanism can let any tenant on a shared ESP IP pool pass SPF as your domain. DMARC alignment then rubber-stamps spoofed mail, and standard mail filtering never sees the forgery as anomalous. Open
Incident Runbooks(4)
Stabilise, recover and validate during incidents.
- DNS TTL misconfiguration on failover records set excessively high, causing stale resolution during DR cutoverA Route 53 failover record set carrying a 21600-second TTL kept resolvers pointing at a dead primary endpoint for hours after health checks correctly triggered failover. Clients behind corporate forwarders and ISP resolvers continued receiving the cached primary IP long after the DR site was live, extending the outage well beyond the declared cutover window. Open
- DNS wildcard CNAME records pointing to decommissioned cloud storage buckets, enabling subdomain takeoverA wildcard CNAME such as *.cdn.example.com still resolves to a deleted S3 or GCS bucket name. Because the wildcard matches every unregistered label under that zone, an attacker who registers the same bucket name in their own cloud account instantly inherits control over an unbounded number of subdomains, not just one. Open
- DNS wildcard records (*.domain.com) combined with subdomain delegation causing unintended certificate issuance via ACMEAn orphaned NS delegation on a subdomain still covered by a parent wildcard A record lets whoever controls the delegated zone complete an ACME dns-01 challenge and obtain a publicly trusted certificate for a hostname that already routes to production infrastructure, because CAA tree-climbing stops at the zone cut. Open
- DNS CNAME records pointing to deprovisioned Azure/AWS resources creating subdomain takeover vulnerabilitiesA CNAME left in Azure DNS or Route 53 after an App Service, Storage account, S3 bucket, or Elastic Beanstalk environment is deleted still resolves to a provider-managed namespace. Because Azure App Service names and S3 bucket names are globally reusable once released, any external party can register the identical name and immediately serve content under your legitimate subdomain. Open