Network & Infrastructure
A missing service record is created, yet some clients continue receiving a negative answer. Their resolvers can legitimately retain the earlier nonexistence response for its negative-cache lifetime.
DNS, DNSSEC & Service Discovery2 min read
Read article : Negative DNS caching after a corrected service record
Network & Infrastructure
A domain answers from its own authoritative servers when queried directly, but normal recursive resolution fails. The parent delegation may point at unreachable or outdated server addresses.
DNS, DNSSEC & Service Discovery2 min read
Read article : Broken delegation glue despite correct child-zone records
Network & Infrastructure
Some queries succeed while others time out because one delegated nameserver is not authoritative for the zone. Resolver server selection can make the fault appear random.
DNS, DNSSEC & Service Discovery2 min read
Read article : Lame delegations and intermittent resolver failures
Network & Infrastructure
A signed zone returns SERVFAIL through validating resolvers while direct authoritative queries appear normal. The parent's DS may no longer match the zone's active trust path.
DNS, DNSSEC & Service Discovery1 min read
Read article : DNSSEC DS mismatch after an unsynchronized signing change
Network & Infrastructure
A zone fails validation even though no records changed recently. Automated signing can stop refreshing signatures while authoritative servers continue serving an otherwise coherent zone.
DNS, DNSSEC & Service Discovery1 min read
Read article : Expired DNSSEC signatures and an unhealthy signing pipeline
Network & Infrastructure
A key rollover works for fresh resolvers but fails for resolvers carrying older key or DS data. The rollout sequence may have ignored previously cached dependencies.
DNS, DNSSEC & Service Discovery1 min read
Read article : DNSSEC key rollover and overlapping cache lifetimes
Network & Infrastructure
Small DNS queries work while DNSSEC-related responses time out across one firewall. Larger UDP responses may fragment or trigger behavior the path does not reliably carry.
DNS, DNSSEC & Service Discovery2 min read
Read article : EDNS response size, fragmentation and DNSSEC timeouts
Network & Infrastructure
A firewall allows DNS UDP but blocks TCP, and only selected lookups fail. Responses that require truncation or larger transfers expose the incomplete service policy.
DNS, DNSSEC & Service Discovery1 min read
Read article : DNS over TCP is a functional dependency, not an optional extra
Network & Infrastructure
An internal service name resolves to a public address for some VPN users. Their query source or resolver selection may place them in a different DNS view.
DNS, DNSSEC & Service Discovery2 min read
Read article : Split-view DNS and answers from the wrong resolver context
Network & Infrastructure
Two enterprise resolvers forward a namespace to each other after a reorganization. Clients see timeouts while both resolvers consume work on queries that never reach an authority.
DNS, DNSSEC & Service Discovery2 min read
Read article : Conditional forwarding loops and recursive query amplification
Network & Infrastructure
A public authoritative server also performs recursion for arbitrary Internet clients. The exposure expands resource use and abuse potential even though the public zone answers correctly.
DNS, DNSSEC & Service Discovery1 min read
Read article : Restrict recursion separately from authoritative answering
Network & Infrastructure
A secondary continues serving stale data after the primary's serial was manually set backward. Comparing serials as ordinary decimal counters can produce the wrong operational conclusion.
DNS, DNSSEC & Service Discovery1 min read
Read article : Zone serial arithmetic and secondaries that never update