DNS: от основ до безопасности

Имена, иерархия, участники DNS и разница между рекурсивным и итеративным разрешением.

1. 1.1Why DNS existsDNS maps names to distributed data; it is neither one central address book nor a security protocol.~10 min
2. 1.2The namespaceLabels, domains, FQDNs, the root, and reading names from right to left.~10 min
3. 1.3Clients, resolvers, and authoritiesThe roles of a stub resolver, recursive resolver, and authoritative server.~12 min
4. 1.4Recursion and iterationWho performs the lookup and how responses change along the way.~12 min

Корень, TLD, делегирования, направления и трассировка запроса от начала до конца.

1. 2.1Root servers and root hintsWhere iterative resolution starts and what root servers actually do.~10 min
2. 2.2TLDs and delegationHow a parent points to a child’s name servers and how to follow that delegation.~12 min
3. 2.3NS and glue recordsNS records, circular dependencies, and address glue in the additional section.~12 min
4. 2.4Reading a DNS traceFollow a complete lookup and distinguish a referral from the final answer.~15 min

Базовые записи, RRset, авторитетные зоны и разбор реальной зоны.

1. 3.1Records, RRsets, and TTLsOwner name, type, class, TTL, and value—and why records are handled in sets.~12 min
2. 3.2A, AAAA, CNAME, and PTRAddress records, aliases, and reverse lookups: their meaning and limits.~14 min
3. 3.3MX, TXT, NS, and SOAMail routing, text metadata, authority, and zone parameters.~14 min
4. 3.4Reading a complete zoneThe apex, relative names, SOA serial, and configuration consistency.~15 min

Положительное и отрицательное кэширование, DNS-ответы и методика диагностики.

1. 4.1Caching and expirationRemaining TTL, resolver caches, and why changes do not take effect everywhere at once.~12 min
2. 4.2NXDOMAIN and NODATATell a missing name from a missing record type, and understand negative caching.~12 min
3. 4.3RCODEs and SERVFAILWhat NOERROR, NXDOMAIN, REFUSED, and SERVFAIL tell you—and what they do not.~12 min
4. 4.4A methodical diagnosisSeparate cache, resolver, delegation, and authority with ordered checks.~15 min

Структура DNS-сообщений, транспорт и чтение вывода диагностических утилит.

1. 5.1Inside a DNS messageThe header, question, answer, authority, additional sections, and key flags.~14 min
2. 5.2UDP, TCP, and EDNS(0)Truncation, retries, TCP transport, and response size.~14 min
3. 5.3Query and compareUse supplied tool output to compare query types, servers, TTLs, flags, and paths.~15 min

Моделирование угроз, открытые резолверы, отравление кэша, передача зон и rebinding.

1. 6.1The DNS attack surfaceProtect registrars, authorities, resolvers, and network paths with proportionate controls.~12 min
2. 6.2Spoofing and cache poisoningHow a forged answer can contaminate a cache and how resolvers reduce the risk.~14 min
3. 6.3Open resolvers and AXFRReduce abuse and amplification; allow zone transfers only to authorized secondaries.~14 min
4. 6.4DNS rebinding and defensesUnderstand the risk to browser-reachable services and controls for internal systems.~14 min

Подлинность и целостность, записи DNSSEC и статусы валидации.

1. 7.1DNSSEC goals and limitsOrigin authentication and data integrity; DNSSEC does not encrypt queries.~12 min
2. 7.2DNSKEY and RRSIGPublic keys and signatures associated with a zone’s published RRsets.~14 min
3. 7.3DS and the chain of trustConnect parent and child zones and follow validation from the root down.~15 min
4. 7.4Secure, insecure, and bogusInterpret validation states and diagnose a broken chain.~15 min

Подписание, смена ключей (rollover), типичные сбои и безопасные процедуры.

1. 8.1Signing and publishing a zoneSignatures, timing, consistent publication, and checks before activation.~15 min
2. 8.2KSK, ZSK, and rolloverKey roles, coordinated changes, and rollover windows.~15 min
3. 8.3Expiration and recoveryDiagnose expired signatures and mismatched DS records; monitor and recover.~15 min

DoT, DoH и минимизация QNAME: разные взаимодополняющие уровни защиты.

1. 9.1What information a query exposesWhat can be observed along the path, the resolver’s role, and encryption limits.~12 min
2. 9.2DoT and DoHDNS over TLS and DNS over HTTPS: transport protection and resolver choice.~15 min
3. 9.3QNAME minimisationReduce the names exposed to authoritative servers during resolution.~14 min

DNS для почты и сертификатов, мониторинг и итоговый аудит домена.

1. 10.1SPF, DKIM, and DMARCHow DNS records support email authentication and what their limits are.~15 min
2. 10.2CAA and DANEDeclare certificate-issuance policy and understand TLSA/DANE and DNSSEC dependence.~15 min
3. 10.3Project: a defensive DNS auditReview a training domain and justify evidence, impact, priority, and fixes.~20 min

Первичные и вторичные серверы, трансфер зон (AXFR/IXFR) и динамические обновления.

1. 11.1Primary, secondary, and NOTIFYSynchronize authoritative copies with SOA serials, NOTIFY, and transfer controls.~15 min
2. 11.2AXFR, IXFR, and TSIGFull and incremental transfers, server authentication, and peer restrictions.~16 min
3. 11.3Dynamic updatesDNS UPDATE, authorization, signing, and credential protection.~15 min

Обнаружение служб (SRV), современные псевдонимы (SVCB), wildcards и обратные зоны.

1. 12.1SRV records and service discoveryPriority, weight, port, and target: publish where a service lives without confusing it with an A record.~14 min
2. 12.2SVCB and HTTPS recordsHow clients can discover connection parameters and alternatives through DNS.~16 min
3. 12.3Wildcards, DNAME, and reverse DNSWildcard behavior, subtree substitution, and in-addr.arpa/ip6.arpa delegations.~16 min

Доказательства несуществования (NSEC/NSEC3), управление доверием и целостность.

1. 13.1NSEC, NSEC3, and negative proofsValidate that a name or type does not exist, and understand what proofs may reveal.~16 min
2. 13.2Trust anchors and automated rolloverKey and DS update mechanisms, checks, and rollback during a transition.~16 min
3. 13.3ZONEMD and zone integrityUse an authenticated digest to detect differences or corruption among zone copies.~14 min

DNS over QUIC, Oblivious-прокси и компромисс геолокации в ECS.

1. 14.1DNS over QUICEncrypted DNS transport over QUIC, connection properties, and differences from DoT and DoH.~15 min
2. 14.2ODoH and DDRSeparate client and resolver with a proxy and discover encrypted DNS options securely.~17 min
3. 14.3EDNS Client Subnet and geolocationWhy a resolver may share part of a client address and what trade-off that creates.~15 min

DNS-туннелирование, алгоритмы DGA, висячие записи и политики фильтрации.

1. 15.1DNS tunneling and DGAsRecognize unusual patterns and use them to start an investigation, not as proof by themselves.~16 min
2. 15.2Dangling records and subdomain takeoverHandle aliases to retired services and reduce risk through inventory and controlled decommissioning.~15 min
3. 15.3DNS filters, sinkholes, and RPZApply traceable, reversible DNS policies while considering false positives and DNSSEC.~15 min

Настоящая избыточность, использование устаревших данных (serve-stale) и реагирование.

1. 16.1Redundancy, secondaries, and anycastAssess name server independence, shared failure modes, providers, and anycast routing.~16 min
2. 16.2Serve-stale and data freshnessBalance service continuity against the risk of reusing expired answers.~15 min
3. 16.3Monitoring and incident responseCorrelate signals from multiple vantage points, follow a runbook, and verify recovery.~17 min