ProtocolMature
DNS
Also known as: Domain Name System
Connected knowledge
Learn and operate with DNS
KBY articles, field notes and operational references linked from the technology registry.
Articles(3)
- Fixing gRPC Load Balancing Behind L4 ProxiesWhy HTTP/2 multiplexing pins gRPC traffic to single backends behind L4 proxies, and how DNS resolvers, round_robin policy, and Envoy EDS fix it. Open
- Detecting DNS Tunnelling via Resolver EntropyHow Shannon entropy scoring, dnstap capture, and PowerDNS Lua hooks catch DNS tunnelling exfiltration that firewall egress rules miss entirely. Open
- Preventing DNS Split-Brain in Hybrid Azure/ADA technical guide to eliminating DNS split-brain in hybrid Azure/AD environments using NRPT, GPO policy and Azure Private DNS Resolver architecture. Open
Graduate(2)
Config Traps(12+)
- Legacy AXFR Flags Survive Windows DNS UpgradesAn in-place upgraded Windows DNS Server can retain a zone-level TransferAnyServer flag from a decommissioned Windows Server 2008 secondary, letting any host on the internal network pull a full AXFR of the AD-integrated zone. Firewall rules and Kerberos authentication never see the query, because zone transfer authorisation is checked entirely inside the DNS service. Open
- Default-Deny Egress Silently Breaks Pod DNS LookupsA cluster-wide egress default-deny NetworkPolicy blocks UDP/TCP 53 to CoreDNS unless an explicit allow rule exists, and the resulting failures surface as connection timeouts and retry storms in application logs rather than obvious DNS errors, sending on-call engineers chasing the wrong service. Open
- Split-Horizon DNS: When Internal Zones Leak OutA single authoritative DNS server configured to serve both internal and external views can answer public queries with RFC1918 records, exposing internal hostnames, subnet layout and service topology to anyone running dig against the public nameserver, with no firewall or WAF positioned to catch it. Open
- BIND9 Secondaries Inherit the Open AXFR DefaultA hardened AXFR policy on the primary nameserver means nothing if the secondaries never got the same allow-transfer ACL. BIND9 falls back to its global any default per zone stanza, so attackers query the slave directly and pull the full zone, exposing every internal hostname without touching the locked-down primary at all. Open
- High DNS TTL on Failover Records Stalls DR CutoverA failover CNAME or A record carries the zone's default TTL of an hour or more, so when disaster recovery routing flips at the authoritative nameserver, cached answers on recursive resolvers, container stub resolvers, and ISP infrastructure keep pointing clients at the dead primary for the full TTL window, regardless of how fast the health check reacts. Open
- CNAME Chains That Outlive the SaaS Account Behind ThemA CNAME chain provisioned for a SaaS custom domain can keep resolving through a vendor's shared edge network long after the underlying account is deleted, because the intermediate hop stays alive and only the final hostname claim expires. Standard dangling-DNS scanners check for NXDOMAIN or dead IPs, miss this state entirely, and never flag the exposure until an attacker claims the same hostname on the same platform. Open
- Wildcard Records Pinned to Dead Load Balancer IPsA wildcard A record bound directly to a load balancer's raw IP survives the load balancer's deletion, and the released IP re-enters the cloud provider's allocation pool within hours. Every unregistered subdomain under that wildcard then resolves to whichever tenant receives the IP next, and no existing takeover scanner flags it because the record was never dangling on a CNAME. Open
- AD-Integrated DNS Zones Still Allow Open TransfersA Windows DNS Server zone left on "Allow zone transfers: To any server" hands out every SRV and host record for a domain controller via a single unauthenticated AXFR query. Active Directory replication does not govern this setting, and standard DC firewall rules and event logging rarely flag the transfer at all. Open
- SPF's +all Catch-All Turns Includes Into Open TrustA hand-edited SPF record with a permissive +all catch-all or an unscoped third-party include mechanism can let any tenant on a shared ESP IP pool pass SPF as your domain. DMARC alignment then rubber-stamps spoofed mail, and standard mail filtering never sees the forgery as anomalous. Open
- CAA Records Restrict CAs, Not Accounts Inside ThemA CAA record naming only the issuing CA's hostname, such as issue "letsencrypt.org", authorises every customer of that CA, not a single account. Any other tenant who passes domain control validation through a stale subdomain, dangling delegation, or orphaned TXT record can obtain a fully CAA-compliant certificate, invisible to standard compliance checks. Open
- Wildcard DNS Records Hide Subdomain Takeover RiskWhen a wildcard record answers takeover scanners' non-existent-label probe, they abort enumeration for the whole zone, so pre-existing dangling CNAMEs to deprovisioned S3, Heroku, or Front Door endpoints stay unflagged. Attackers instead mine certificate transparency logs, claim the orphaned third-party slug, and serve phishing content trusted by cookies, CSP, and SSO redirect rules. Open
- Open AXFR: Your Nameserver Handing Out the Whole ZoneNameservers left with allow-transfer absent or set to any hand out complete zone dumps via a single dig axfr query. Every subdomain, internal hostname, VPN endpoint, staging server, and mail exchanger becomes visible to any unauthenticated party, handing attackers a ready-made reconnaissance map with no logging distinction from legitimate secondary syncs. Open