DNS Terminology

The .arpa domain is so far the only infrastructure top level domain and is an acronym for Advanced Research Projects Agency. The in-addr.arpa and ip6.arpa is used for reverse mapping between IP addresses (IPv4 and IPv6) and domain FQDN’s. uri.arpa and urn.arpa is used by the Dynamic Delegation Discovery Service and the e164.arpa for telephone number mapping based on NAPTR records..

IPv4 Address resource record type. RFC 1035.

IPv6 Address resource record type. RFC 3596.

Advanced Persistent Threat. Highly skilled and advanced “hacker groups”. Often state-sponsored. Persistent in ways that they will not give up once exposed but just regroup and try a different approach.

Asynchronous zone transfer. Protocol used by slave servers to transfer the entire zone from a master. The connection uses TCP as transport. RFC 1035.

A control the resolver performs for each query response making sure the response only contains relevant data to the query in the authority and additional section of the query response.

Brand Indicator for Messages Identification. Allows for showing your brand logo next to authenticated email messages. Internet-Draft.

Berkeley Internet Name Daemon. The first ever DNS software, written in the early 1980s at the University of California at Berkeley as a graduate-student project. BIND is currently developed and maintained by the ISC, Internet Software Consortium, and still have a substantial market share by Internet facing name servers.

A network of hacked hosts under control of a hacker group. Some botnets can be rented by the hour and is often used in different DDOS attacks. 

A way of “guessing” for example a password or encryption key by exhausting all possible character combinations until successful.

Short term storage for previous queries and query responses used by resolvers to speed up name resolution. 

Command and Control channel often used by malware to receive instructions and additional code. In many cases the DNS protocol is used to create a C2 channel.

Country Code Top Level Domain. Used or reserved for a country or sovereign state and in some cases dependent territories identified with a country code. All ASCII ccTLD’s are two letters long. There are currently more than 300 top level domains registered

Child copy of the DNSKEY resource record, for copy to parent. RFC 7344.

Child DS. Copy of the DS resource record, for transfer to parent. RFC 7344.

Computer Emergency Response Team. An Incident response team specialised in computer security incidents. CERTs are usually operated on governmental leves and larger companies. CERTs keep track of security incidents and issues warnings and remedies for discovered cyber threats.

DNS resource record that stores PKIX, SPKI, PGP, etc. RFC 4398.

The Chaos class is used by Chaosnet which is a network implementation that never made it.

A domain directly below another domain in the domain name hierarchy is called a child while the domain above is called a parent. Delegation information in a child zone must be copied to the parent zone to be able to find the child.

Originally intended to identify “protocol family”. The IN (Internet) class is by far the most used en even if there are some use of other classes they are on the verge of being irrelevant. The registered classes are IN, CS, CH and HS. 

A resource record that maps a domain name to another. RFC 1035.

CSNET. Obsolete DNS class.

Child-to-Parent synchronisation. Specify a synchronisation mechanism between child and parent DNS zone. Can only be used on DNSSEC signed zones. RFC 7477.

DNS-based Authentication of Named Entities. Used to securely associate cryptographic keys and/or certificates with domain names for application services, using signed DNS records. RFC 6698, RFC 7671, RFC 7672 and RFC 7673.

Dynamic DNS. A standard used to let clients dynamically update its record data. RFC 2136.

The information that identifies the authoritative DNS servers of a specific domain or zone. Delegation information is NS resource records and in special circumstances also A and AAAA records known as “glue records”.

DHCP Identifier. Used by the DHCP protocol to identify connecting hosts and to assign them individual DHCP options. RFC 4701.

Department of Homeland Security Cybersecurity and Infrastructure Security Agency.

DomainKeys Identified Mail. A DNS TXT record that holds the public key signature used to authorise the mail sender. RFC 6376.

Domain-based Message Authentication. A policy telling the mail receiver how to handle emails that fails authentication and how it should be reported. RFC 7489.

DNS resource record type used to map a sub-tree of the DNS name space to another domain. RFC 6672.

DNS resource record type containing the public DNSSEC signing keys. RFC 4034.

DNS Security Extensions. A standard used to validate the authenticity of DNS resource record sets with public key cryptography. RFC 4033, RFC 4034 and RFC 4035. Best current practices are compiled in RFC 9364.

DNS over HTTPS. A protocol standard to perform name resolution over HTTPS to ensure end user privacy. RFC 8484.

DNS over QUIC. A standard to perform name resolution using the QUIC protocol. RFC 9250.

DNS over TLS. A standard to perform name resolution by wrapping the DNS queries and answers via TLS. RFC 7858.

DNS over TLS. A standard to perform name resolution by wrapping the DNS queries and answers via TLS. RFC 4034.

Extension mechanisms for DNS. A standard to extent the DNS protocol beyond its original limitations. RFC 6891.

DNS Endpoint Identifier resource record. RFC 6830.

Extensible Provisioning Protocol. Standard for changing the domain data that is displayed by RDAP/WHOIS. RFC 5730.

48 bit Extended Unique Identifier resource record for use in various layer-2 networks. RFC 7043.

64 bit Extended Unique Identifier resource record for use in various layer-2 networks. RFC 7043.

Term used when using covert channels to send data, usually between a malware & the attacker.

The time a slave server will serve a zone without any contact with the master. After this time is reached, the zone content will no longer count as reliable and the server will stop responding to queries for the zone.

An acronym for Fully Qualified Domain Name. The name www.example.com is a FQDN while the first part of the FQDN is the host name.

IP address records (A/AAAA) attached to NS resource records in a parent zone to identify the name servers IP addresses.

Generic Top Level Domain. General purpose TLD’s were defined in RFC920 and created back in 1984. The most well-known gTLD is .com with well over 160 million registrations.

Generic Top Level domains with restrictions specified by the registry.

The Hesiod class. Has its origins in project Athena See wikipedia link. Available but not widely used.

Beside its original abbrevation, Hyper Text Transfer Protocol Secure, the HTTPS is also a DNS resource record that, together with the SVCB record is created to improve performance by supplying connection specific data to the client before its first connection to its target. RFC 9460.

Internet Assigned Numbers Authority. Provide global coordination of the DNS root, IP addressing, and other Internet protocol resources.

Internationalised domain name. An effort to accept non-Latin alphabet characters in the domain name space. Since the domain name system only works with ASCII characters Punycode is used to make it operable. RFC 5890.

Internationalised top level domain. TLD’s with non-Latin alphabet.

Internet Engineering Task Force. Responsible for the development of the Internet and its standards

The Internet class. Basically the only one used in the DNS today.

IPSEC KEYing information resource record. RFC 4025.

Internet society. Supports and promotes the development of the Internet as a global technical infrastructure.

Incremental zone transfer. Protocol used by slave servers to only transfer current changes of the zone content from a master. The connection uses UDP as transport. RFC 1995.

An open standard file format for storing and transporting data. Read more at json.org.

DNSSEC Key Signing Key.

Key Exchanger record. It has a limited deployment but is still in use. RFC 2230.

DNS resource record. Used to hold 32-bit Locator values for ILNPv4 capable nodes. Experimental. RFC 6742.

DNS resource record. Used to hold unsigned 64-bit Locator values for ILNPv6-capable nodes. Experimental. RFC 6742.

DNS resource record. Location Pointer to L32 and/or L64 records. Holds the name of a subnetwork for INLP. Experimental. RFC 6742.

DNS Geo-Location resource record. Contains WGS84 Latitude, Longitude and Altitude. RFC 1876.

The master server contains the original data of the zone and is usually where it is edited.

Multi Factor Authentication. Also known as 2FA, Two Factor Authentication. Used to strengthen normally weak authentication methods like User-ID and passwords.

Man-In-The-Middle. A nasty form of cyberattack where the attacker reroutes a connection to eavesdrop in order to gain sensitive information such as account names, passwords, credit card information and such. Very hard to detect.

Mail Transfer Agent. A server capable of sending emails over the SMTP protocol.

Mail Exchanger resource record. Contains a list of names and priorities of mail servers for a domain. RFC 1035 and RFC 7505.

Naming Authority Pointer. Allows for regular-expression-based rewriting of domain names which can than be used as URIs, further domain names to look up, etc. RFC 3403.

The time a resolver is supposed to cache “incorrect” responses, like responses with the NXDOMAIN response code. RFC 9499. New proposed standard in RFC 9520.

DNS resource record. Node Identifier record used for ILNP-capable nodes. Experimental. RFC 6742.

A notification is usually used by the master server to signal slave servers that an update to the zone content is present. Upon receiving a notify message the slave servers will initiate a zone transfer by either AXFR or IXFR protocols. RFC 1996.

Zone delegation record. Points to the authoritative DNS servers responsible for a zone. RFC 1035.

Next Secure record. Part of DNSSEC which provides proof of non-existence. RFC 4034.

Next Secure record version 3. Part of DNSSEC which provides proof of non-existence without permitting zonewalking. RFC 5155.

DNS record which provides parameters when using NSEC3. RFC 5155.

OpenPGP public key record. RFC 7929.

Delegation information is shared between parent and child to be able to identify the name server responsible for the lower “branches” in the domain name “tree”. The parent is above the child in the domain name hierarchy.

A domain that is registered to no apparent use other than to stop others from register it. Many companies like to have their names and trademarks registered in many ccTLD’s as well as generic TLD’s. Usually the domains contains records redirecting possible traffic to the organisations main web site.

Pointer Resource record. Primarily used for mapping IP addresses to Canonical names. RFC 1035.

Punycode transcode Unicode characters to a subset of ASCII consisting of letters, digits and hypens, LDH.

A general purpose transport layer network protocol. Read more at quicwg.org.

Registration Data Access Protocol. Replacement for WHOIS. Eventually… RFC 7480, RFC 7481, RFC 7482, RFC 8056, RFC 9082 and RFC 9083.

Part of the resolver iteration process when an authoritative DNS server refers the resolver to another authoritatiove DNS server with a higher probability to know the correct query response.

Organisations handling domains acting as an intermediate between end customer and domain registries.

Organisation managing a Top Level Domain.

A system responsible for resolving DNS queries. This is done through an iterative process by querying authoritative name servers from the top of the domain name tree and until a query reply is received from the DNS authoritative for the domain in the query. To speed up the process, a resolver stores all previous referrals and responses in cache.

Request For Comment. Technical publications consisting of proposals and established Internet standards maintained by the IETF. Not to be confused with the term Request For Change that is common in organisations using ITIL derivates.

The apex of the domain name tree, and the home for the thirteen root name servers, from where most recursive queries start its iterative journey to identify the records in a query.

Responsible Person resource record. RFC 1183.

Response Policy Zone. An open and vendor-neutral standard for the interchange of DMS firewall configuration information.

DNS Resource Record.

Resource Record Signature. Cryptographic signature used by DNSSEC to sign Resource Record sets. RFC 4034.

Simple Authentication and Security Layer. A framework for authentication and security in Internet protocols.

Security Information and Event Management.

Signature resource record used in SIG(0) and TKEY for applications outside DNSSEC. RFC 2535.

A slave server holds an exact replica of the Masters zone data. The Slave servers maintain the accuracy of the zone content by transfer the zone at fixed intervals or when prompted by a Notification message.

Simple Mail Transfer Protocol. Specifications can be found in RFC 5321

The Start of Authority record. Contains information about how the zone should be recognised and treated by slaves and resolvers. There must exist exactly one SOA record in every zone. The SOA contain the following information:
Name of zone, Serial number, Master name, Responsible person, Refresh, Retry, Expire and Negative cache TTL. RFC 1035.

Master name. Zone host of origin. Used by dynamic update clients to locate where to send update requests to.

Interval for when the slave servers should check with master for zone updates.

If a slave fails to reach the master when trying to Refresh, this number tells the slave at what interval it should try again.

Responsible technical contact for zone. An email address to contact zone responsible.

Used by slaves to track changes to zone content.

Security Orchestration, automation, and Response.

Unsolicited sending of email through poorly secured email servers. Frequently used for phishing and other shady operations.

Sender Policy Framework. Once proposed as a separate resource record type byt is obsoleted today and replaced by the TXT record subtype with the same name. RFC 7208.

Service locator resource record. Used for newer protocols instead of creating protocol-specific resource record types. RFC 2782.

SSH Public Key Fingerprint. Used for publishing SSH public key fingerprints in the DNS, in order to aid in verifying the authenticity of a host. RFC 4255.

A stealth server is a DNS Master or Slave server that is not listed in the zones NS or SOA resource records. This way the server will not be found by DNS resolvers and will not receive any queries unless they are directed to the stealth server by other means.

Sponsored Top Level Domain are sponsored by organisations with a special purpose or theme concept. Most of the sTLD’s require adherence to specific criteria for allowing registration.

Service Binding resource record. A RR that improves performance for clients that need to resolve many resource records to access a domain. RFC 9460.

Transport Control Protocol. Part of the Internet protocol. Connection oriented protocol that begins with a three-way handshake.

Transaction Key record. RFC 2930.

Top Level Domain. The domains directly below the root domain in the domain name space.

TLS Certificate Association. Used by DANE to associate a TLS server certificate or public key with the domain name where the record is found. The record should be used in a DNSSEC signed zone to work properly. RFC 6698.

Transaction Signature. Usually used to authenticate dynamic updates, sone transfers and notifications. RFC 2845.

Time To Live. Every resource record have a TTL which tells a resolver how long the record should be kept in cache before it is dropped and a new query is required. RFC 1035.

Testing Top Level Domains. These are reserved TLD’s that will never be registered in the root zone and is safe to be used for testing purposes. The following are tTLD’s: .example, .invalid, .localhost and .test

Transaction Identifier. Part of the DNS protocol used to match a DNS query to a query response.

Text resource record. A versatile DNS record that has many uses. RFC 1035.

User Datagram Protocol. One of the core protocols in the Internet Protocol suite. Packets are sent as datagrams and require no established connection to the other host which makes it very fast.

Uniform Resource Identifier. Can be used to publish mappings from host names to URI’s. RFC 7553.

A human-readable serialisation language. Read more at yaml.org.

Message Digest for DNS zones. Provides a cryptographic message digest over DNS zone data at rest. RFC 8976.

DNSSEC Zone Signing Key.