ماڈیول اسباق (3/3)
Monitoraggio e risposta agli incidenti
Monitoring and incident response
DNS monitoring should distinguish resolver availability, data correctness, and performance. A single probe from one network may miss delegation or routing problems elsewhere. Check from several vantage points: query authoritative servers, resolve through recursive resolvers, validate DNSSEC, and track latency, timeouts, RCODEs, and signature expiry.
A simple runbook defines impact and start time; preserves timestamped queries and responses; compares parent, child, and resolver; identifies the last change; assigns an owner; applies the smallest correction; verifies from multiple networks; and records recovery and prevention steps.
If an application reports SERVFAIL, do not immediately edit records. Find out whether it affects one resolver or many, inspect delegation and DNSSEC, then compare authority with cache. Preserve evidence before flushing caches or changing several variables. A useful service-level indicator measures successful resolution of important records, not merely whether the DNS process is running.
Reference: RFC 9199 — operational considerations for authoritative DNS
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
Which measure helps distinguish a local failure from a global one?