1. Goal

RPZ rules for block, passthru and NXDOMAIN are modeled as security control.

2. What is done

The example creates local evidence below work/, validates zone files and checks optional tool output when DNS tools are installed.

3. Why it is done

DNS failures often look like application or network failures. Only RCODE, SOA, TTL, delegation, resolver path and cache state allow reliable root cause analysis.

4. Typical commands

dig example.test SOA +norecurse 2>/dev/null || true
dig www.example.test A +dnssec 2>/dev/null || true
dig example.test NS +trace 2>/dev/null || true
named-checkzone example.test zones/db.example.test 2>/dev/null || true

5. Verify success

• Artifacts are syntactically valid.
• Evidence exists below work/evidence/.
• RCODE, RRtype and zone are named.
• TTL, cache or delegation are framed when needed.
• No production secrets are used.

6. Common mistakes

• Zone file without SOA or NS.
• CNAME with other records at the same owner name.
• Missing glue for in-zone name servers.
• DNSSEC SERVFAIL mistaken for network failure.
• TTL and negative cache behavior underestimated.

7. Security aspects

DNS is infrastructure. Wrong resolver ACLs, open transfers, unsafe dynamic updates or weak DNSSEC processes can have broad impact.

8. Realistic use

The example applies to provider changes, internal zones, Kubernetes DNS, split-horizon designs, mail DNS, resolver operations and incident response.

9. Workshop flow

1. Read the goal.
2. Open artifacts.
3. Run run.sh.
4. Inspect evidence.
5. Name the DNS role.
6. Explain RCODE and RRtype.
7. Evaluate TTL and rollback.
8. Review the result.

10. Review matrix

Official References

• RFC 1034: https://datatracker.ietf.org/doc/html/rfc1034
• RFC 1035: https://datatracker.ietf.org/doc/html/rfc1035
• RFC 8499: https://www.rfc-editor.org/info/rfc8499/
• RFC 6891 EDNS(0): https://datatracker.ietf.org/doc/html/rfc6891
• RFC 4033 DNSSEC: https://datatracker.ietf.org/doc/html/rfc4033
• RFC 9364 DNSSEC BCP: https://www.rfc-editor.org/info/rfc9364/
• ISC BIND 9 Documentation: https://bind9.readthedocs.io/
• CoreDNS Documentation: https://coredns.io/manual/toc/

Example Appendix: Evidence, Operations and Transfer

This appendix makes the example complete as a training component. It describes how a local DNS model becomes reliable analysis without touching production domains or provider credentials.

B.1 Define scope

Define scope is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.2 Validate artifacts

Validate artifacts is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.3 Name DNS role

Name DNS role is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.4 Interpret RCODE

Interpret RCODE is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.5 Evaluate TTL

Evaluate TTL is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.6 Check delegation

Check delegation is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.7 Record security boundaries

Record security boundaries is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.8 Write rollback

Write rollback is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.9 Clean evidence

Clean evidence is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.10 Run cleanup

Run cleanup is required because DNS failures are often explainable only by combining zone, resolver path, cache and transport. The assessment must state whether an artifact only explains, validates locally or would be applied to a real zone.

Review points:

• no production zones
• no real TSIG or DNSSEC keys
• no provider API tokens
• no unreviewed TTL or delegation changes
• cleanup possible by removing work/

B.11 Completion

An example is complete when the script runs successfully, all artifacts are syntactically valid, the DNS role is named and evidence contains no confidential data.