1. Scope

Scope is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Scope:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

2. Name space

Name space is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Name space:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

3. Resolver path

Resolver path is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Resolver path:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

4. Authoritative data

Authoritative data is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Authoritative data:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

5. Zone files

Zone files is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Zone files:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

6. Delegation

Delegation is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Delegation:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

7. Caching

Caching is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Caching:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

8. Negative caching

Negative caching is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Negative caching:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

9. Record types

Record types is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Record types:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

10. Transport

Transport is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Transport:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

11. DNSSEC

DNSSEC is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for DNSSEC:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

12. Transfers

Transfers is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Transfers:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

13. Resolver policy

Resolver policy is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Resolver policy:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

14. Kubernetes DNS

Kubernetes DNS is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Kubernetes DNS:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

15. Monitoring

Monitoring is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Monitoring:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

16. Operations

Operations is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Operations:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

17. Security

Security is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Security:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

18. Troubleshooting

Troubleshooting is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Troubleshooting:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

19. Review

Review is treated as a reviewable DNS building block in this workshop. The relevant point is not just a query, but its position in the name space, zone, delegation, resolver path, cache, transport and security model.

dig example.test SOA +norecurse 2>/dev/null || true
dig @127.0.0.1 example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
python3 tools/zone_lint.py zones/db.example.test 2>/dev/null || true

Practical notes for Review:

• DNS is distributed and cached; local changes are not automatically globally visible.
• TTL and negative TTL determine how quickly corrections take effect.
• CNAME must not collide with other data at the same owner name.
• Delegations need consistent NS records and glue where required.
• DNSSEC protects integrity and origin, but not confidentiality.
• EDNS extends DNS messages and matters for DNSSEC response sizes.
• Public, private and Kubernetes-internal DNS views must be evaluated separately.

Common failure modes:

Review questions:

• Which DNS role is affected: stub, recursive resolver or authoritative server?
• Which zone, name or RRset is affected?
• Which response is expected: NOERROR, NXDOMAIN, NODATA, SERVFAIL or REFUSED?
• Which TTL, SOA or delegation decision affects behavior?
• Which evidence supports the finding?
• Which change would be risky in production?

Submission format for Best Practices:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  risk-note.md
  cleanup.md

Official Sources and Boundary

• RFC 1034, Domain Names - Concepts and Facilities: https://datatracker.ietf.org/doc/html/rfc1034
• RFC 1035, Domain Names - Implementation and Specification: https://datatracker.ietf.org/doc/html/rfc1035
• RFC 8499, DNS Terminology: https://www.rfc-editor.org/info/rfc8499/
• RFC 6891, Extension Mechanisms for DNS (EDNS(0)): https://datatracker.ietf.org/doc/html/rfc6891
• RFC 4033, DNS Security Introduction and Requirements: https://datatracker.ietf.org/doc/html/rfc4033
• RFC 9364, DNSSEC Best Current Practice: https://www.rfc-editor.org/info/rfc9364/
• IANA Root Zone Database: https://www.iana.org/domains/root/db
• ISC BIND 9 Documentation: https://bind9.readthedocs.io/
• CoreDNS Documentation: https://coredns.io/manual/toc/

This workshop does not introduce DNS protocol rules. It maps official DNS concepts into labs, review questions, zone files, resolver models and operational workflows.

Practice Appendix: DNS Evidence for best-practices-dns-EN.md

This appendix connects the file with repeatable DNS evidence. A DNS statement is reliable only when role, zone, name, RRtype, RCODE, TTL, resolver path and operational impact are reviewed together.

A.1 Namespace and FQDN

DNS starts with a hierarchical namespace. Every analysis must clarify whether a name is relative, fully qualified, part of a zone or affected by a local stub resolver search path.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.2 Stub Resolver

The client stub resolver usually knows only local resolvers and search lists. Errors in resolv.conf, systemd-resolved or search domains can look like server failures.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.3 Recursive Resolver

A recursive resolver performs iteration, caching, DNSSEC validation and forwarding. It is not the same as the authoritative server for a zone.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.4 Authoritative Server

Authoritative servers answer from zones. They should not provide open recursion and need clear zone ownership, transfer rules and monitoring.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.5 Zone and Apex

A zone starts at the apex and contains SOA, NS and authoritative RRsets. Every change needs serial policy, review and rollback.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.6 SOA and Serial

SOA controls zone metadata, refresh, retry, expire and negative cache time. Serial values matter for secondary servers and audit.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.7 TTL and Cache

TTL controls how long answers are cached. Before migrations TTLs must be lowered early enough and stabilized after the change.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.8 Negative Caching

NXDOMAIN and NODATA are cached through SOA information. This explains why deleted or newly created names are not visible everywhere immediately.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.9 Delegation

Delegation connects parent and child zone. NS records, glue and child SOA must be consistent or subtle outages appear.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.10 Glue Records

Glue is needed when name server names live inside the delegated zone. Wrong or missing glue can prevent reachability of the child zone.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.11 Record Types

A, AAAA, CNAME, MX, TXT, SRV, PTR, NS and SOA have different rules. A CNAME must not be combined with other data at the same owner name.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.12 Mail DNS

SPF, DKIM and DMARC are DNS-based mail policy data. Syntax, TTL and organizational ownership must be reviewed separately.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.13 Reverse DNS

PTR zones belong to address space, not the forward zone. Ownership and delegation often differ from the domain zone.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.14 Transport

DNS uses UDP and TCP. EDNS extends UDP response sizes; fragmentation, TC bit and TCP fallback are common failure sources.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.15 EDNS

EDNS(0) enables larger responses and DNSSEC transport, but can be broken by firewalls or middleboxes.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.16 DNSSEC

DNSSEC protects origin and integrity, not confidentiality. DS, DNSKEY, RRSIG, NSEC/NSEC3 and validation status must be reviewed together.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.17 TSIG

TSIG protects zone transfers and dynamic updates with shared keys. These keys do not belong in repositories and need rotation.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.18 Zone Transfer

AXFR and IXFR are operational functions. Allow-transfer, notify, secondary servers and audit must be documented clearly.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.19 Dynamic Update

DNS UPDATE should be allowed only with narrow policy and TSIG. Uncontrolled updates can destroy zone integrity and audit.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.20 Split Horizon

Split horizon creates different answers per view. This is legitimate, but troubleshooting and security review must name the affected view.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.21 Resolver Privacy

DoT, DoH and QNAME minimization affect transport and privacy. They do not replace DNSSEC or correct zone data.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.22 RPZ and DNS Firewall

Response policy zones and DNS firewalls are security controls. They need clear policy, logging, exception process and abuse prevention.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.23 Kubernetes DNS

CoreDNS in Kubernetes combines service discovery, cluster domains and forwarding. Failures can come from CoreDNS, kube-dns configuration, NetworkPolicy or upstream DNS.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.24 Monitoring

DNS monitoring must cover RCODE distribution, latency, SERVFAIL rate, NXDOMAIN spikes, transfer status, DNSSEC validation and zone serials.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.25 Incident Response

DNS incidents need fast classification: affected view, resolver path, RCODE, TTL, cache, delegation, DNSSEC and recent changes.

Concrete review questions:

• Which DNS role is affected?
• Which zone and owner name are affected?
• Which RRtype and RCODE were observed?
• Which TTL or negative cache time applies?
• Which delegation or resolver path is involved?
• Which security control is relevant?
• Which evidence contains no secrets?
• What is the rollback?

Typical evidence:

evidence/
  query-output.txt
  zone-review.txt
  resolver-path.md
  ttl-and-cache.md
  rollback.md

A.26 Minimal Completion Evidence

• RCODE, RRtype, zone and resolver path are documented.
• Zone files contain SOA and NS and do not violate CNAME rules.
• TTL, negative cache time and rollback window are named.
• DNSSEC, TSIG or ACLs are not claimed without evidence.
• Evidence contains no production secrets, API tokens or zone keys.
• Official RFCs and tool documentation replace assumptions.