Network & Infrastructure / DNS, DNSSEC & Service Discovery
Zone serial arithmetic and secondaries that never update
A secondary continues serving stale data after the primary's serial was manually set backward. Comparing serials as ordinary decimal counters can produce the wrong operational conclusion.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record the SOA serial on every server, transfer logs, primary designation and recent edits. Check whether the signing or provisioning pipeline owns serial generation.
Explain the result
DNS serial comparison uses defined sequence-space behavior rather than an unlimited monotonically increasing integer. An ill-planned manual edit can make a newer file appear older to a secondary.
Plan the fix
Use the authoritative platform's supported serial recovery and transfer procedure. Fix the automation that generated the bad sequence instead of repeatedly editing individual secondaries.
Check the result and rollback
Verify converged serials and record contents on every server, then perform another ordinary update. Revert the publication pipeline if subsequent updates again fail to advance as expected.