network dns
A record
Name to IPv4 address. The record people mean when they say the IP for the site.
Knowledge
AllIRacsc-glossaryau-compliancecloudconceptscryptodetectiondnsframeworkshardeningidentityloggingmalwarenetworkpractitionerprivacythreat-intelvulnerability
20 entries
network dns
AAAA record
Name to IPv6 address. Four As. Still forgotten in allow-lists that only list v4.
network dns concepts
Authoritative vs recursive DNS
One holds the zone. The other hunts for an answer and caches it. Mixing them up is how outages get misread.
network dns hardening
CAA record
Which certificate authorities may issue for this domain. A DNS policy, not a certificate.
network dns
CNAME
An alias: this name is that name. People sometimes say "C record"; they mean CNAME. There is no DNS type called a C record.
network dns concepts
DNS
The internet's name system. Stub asks recursive; recursive walks to authoritative. Analysts live in the query log.
network dns
DNS over HTTPS and DNS over TLS
Encrypt DNS on the path. The resolver still sees the names. DoH can walk around enterprise DNS logging.
network dns detection
DNS spoofing
A fake DNS answer wins. Cache poisoning is the recursive version. Logging and resolver choice matter.
dns detection network
DNS tunnelling
Data moved through DNS queries and answers. Detection is odd volume, long labels, and unusual types.
network dns hardening
DNSSEC
Signatures on DNS data. Authenticity and integrity of answers. Not a VPN. Not HTTPS.
dns detection IR
Domain generation algorithm
Malware derives many domains so blockers lag. Hunt high NXDOMAIN and labels that look generated, not a brand.
network dns detection
Fast flux
A hostname whose A or NS answers keep rotating. A resilience trick used by some botnets. Short TTL plus churn.
network dns
MX record
Where mail for this domain should be handed. A hostname and a preference, not an IP in the MX itself.
network dns
NS record
Which nameservers are authoritative for this zone. Delegation lives here.
network dns
PTR record
Reverse DNS. Address back to a name, under in-addr.arpa or ip6.arpa.
dns detection threat-intel
Passive DNS
Historical DNS answers observed by sensors. Pivot on an IOC. Not a replacement for a live lookup.
network dns
SOA record
Start of authority. One per zone. Serial, timers, and who is supposed to be in charge.
network dns
SRV record
Service location: this protocol on this domain lives at that host and port.
network dns concepts
TTL
Time to live. How long a resolver may cache this answer. Seconds, not a promise the world forgets on cue.
network dns
TXT record
Free-form text on a name. SPF, DKIM, and DMARC live here. So does a lot of vendor noise.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary