ProtocolMature
DNS
Also known as: Domain Name System
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
Technology explained
What is DNS?
The Domain Name System is a distributed naming service that maps domain names to records used by applications and networks. This profile connects the concept to KBY's practical engineering guidance.
Resolvers follow referrals through the DNS hierarchy and cache answers according to their time to live. Authoritative zones publish records such as A, AAAA, CNAME, MX and TXT; delegation, DNSSEC, split-horizon design and cache behaviour strongly affect reliability.
Primary purpose
Translate stable names into service and network information.
Typical environments
InternetEnterprise Networks
Typical use cases
- Resolving domain names to IP addresses
- Service discovery
- Email routing (MX records)
Connected knowledge
26+ resources for DNS
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Technology journey
Learn and operate with DNS
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Systems Engineering(3)
Learn the architecture, concepts and engineering context.
- Fixing gRPC Load Balancing Behind L4 ProxiesWhy HTTP/2 multiplexing pins gRPC traffic to single backends behind L4 proxies, and how DNS resolvers, round_robin policy, and Envoy EDS fix it. Open
- Detecting DNS Tunnelling via Resolver EntropyHow Shannon entropy scoring, dnstap capture, and PowerDNS Lua hooks catch DNS tunnelling exfiltration that firewall egress rules miss entirely. Open
- Preventing DNS Split-Brain in Hybrid Azure/ADA technical guide to eliminating DNS split-brain in hybrid Azure/AD environments using NRPT, GPO policy and Azure Private DNS Resolver architecture. Open
Graduate Learning(2)
Build practical knowledge and hands-on skills.
Daily Triage(5)
Practise diagnosis through bounded engineering scenarios.
- Conflicting Resolver Alerts Obscure a Stale DNS AnswerOpen
- Conflicting DNS Alerts During Network DegradationOpen
- Split-Horizon DNS Mismatch Causes Intermittent Service FailuresOpen
- A Blocked Zone Transfer Leaves Secondary DNS Serving Stale RecordsOpen
- Split-Horizon DNS Answers Diverge After a Failed Zone TransferOpen
Config Traps(12+)
Recognise and avoid known failure modes.
- DMARC pct Left Unset Silently Caps Enforcement at Zero Despite a p=reject PolicyA DMARC record using p=reject with pct omitted relies on a specification default that some mail paths do not honour identically to an explicit value, leaving spoofed mail delivered while aggregate reports look clean. Open
- A CAA Record Missing the Renewal CA Silently Blocks Certificate IssuanceA CAA record naming only the original CA silently blocks renewal or failover issuance from any additional CA, even though prior issuance succeeded and the domain appears correctly configured. Open
- DNS Resilience Defaults Silently Override Expected SafeguardsA resolver's negative-caching TTL can silently outlast an intended DNS failover window, making a resilience design look broken when the real fault is a caching default nobody reviewed. Open
- A Wide-Open DNS Forwarder ACL Lets Any Client Recurse Through Your ResolverA DNS resolver left with an open or unscoped recursion ACL answers internal clients normally while silently permitting recursive queries from any network that can reach it, exposing the organisation to amplification abuse and cache poisoning risk. Open
- Allowing Nonsecure Dynamic Updates Lets Any Host Hijack an AD-Integrated DNS ZoneAn AD-integrated DNS zone left on Nonsecure and secure dynamic updates accepts unauthenticated record writes from any reachable host, letting rogue devices silently hijack names used by domain controllers and services. Open
- Restricting AXFR by Source IP Alone Still Lets a Secondary Nameserver Leak the Full DNS ZoneIP-based zone transfer restriction on the primary server is not equivalent to authenticated transfer. If a secondary nameserver retains a default or broad allow-transfer setting, the full zone remains exposed to any client that queries it directly. Open
- Orphaned NS Delegation Leaves a DNS Subdomain Open to TakeoverA stale NS delegation to a decommissioned third-party DNS zone silently enables subdomain takeover. Here is the diagnosis, correction, validation and rollback path. Open
- Enabling DNS Aging Without Server-Level Scavenging Never Removes Stale Active Directory RecordsZone-level DNS aging and server-level scavenging are independent switches in Active Directory DNS. Enabling one without the other leaves stale records silently in place. Open
- A Fourth SPF Include Record Silently Breaks DMARC Alignment for All SendersA routine SPF include addition silently breaks DMARC alignment once total DNS mechanism lookups exceed the evaluator ceiling, with no DNS-side error to flag it. Open
- Apex-Only CAA Leaves CNAMEd Subdomains Open to Unauthorized IssuanceCAA records at a domain's apex look protective in every audit, but a subdomain CNAMEd to a shared zone is checked against that zone's CAA policy instead, silently exposing it to unapproved certification authorities. Open
- Healthy Secondary DNS Still Leaves a Single Point of FailureWhy a fully synchronised, healthy secondary DNS server can still leave a domain with a single point of failure - and how to prove, verify and safely reverse the fix. Open
- Legacy AXFR Flags Survive Windows DNS UpgradesAn in-place upgraded Windows DNS Server can retain a zone-level TransferAnyServer flag from a decommissioned Windows Server 2008 secondary, letting any host on the internal network pull a full AXFR of the AD-integrated zone. Firewall rules and Kerberos authentication never see the query, because zone transfer authorisation is checked entirely inside the DNS service. Open
Incident Runbooks(3)
Stabilise, recover and validate during incidents.
- DNS & Certificate Lifecycle Security Outage: Stabilise and Recover DNSStabilise a DNS outage caused by certificate lifecycle misconfiguration. Validate resolver health, restore trusted certificate chains, and verify resolution with bounded rollback steps. Open
- Cloud DNS Security Incident: Diagnose and Recover DNSA bounded runbook for diagnosing, containing and recovering a Cloud DNS Security incident, gated on evidence at every remediation step. Open
- Cloud DNS Security Failure: Restore DNS SafelyThis runbook details the steps to safely stabilise and recover from a Cloud DNS Security failure, focusing on DNS resolution issues. It covers diagnosis, remediation, validation, and recovery. Open