72 definitions associated with Security.
A rule set that permits or denies operations based on attributes such as source address, identity, network, or transaction type. DNS and DHCP ACLs commonly control recursion, zone transfers, updates, queries, and administrative access.
A policy controlling which clients may ask a DNS server questions. It is commonly enforced globally, per view, or per zone.
A policy controlling which clients may use a resolver to perform recursive resolution. Restricting recursion prevents an internal resolver from becoming an open resolver.
A policy controlling which systems may request AXFR or IXFR zone transfers. Transfers should normally be limited to designated secondaries and management systems.
Common shorthand for BloxOne Threat Defense, Infoblox's protective DNS and DNS security service. It combines policy, threat intelligence, reporting, and cloud or hybrid enforcement components.
A configuration that intentionally returns no useful result or directs selected names to a non-routable or controlled destination. The term can refer to policy blocking, sinkholing, or routing a DNS service address to discard traffic.
A list of domains, addresses, clients, or indicators for which an action such as deny, redirect, log, or quarantine is applied. Modern documentation often uses blocklist instead of blacklist.
An Infoblox DNS security platform that applies protective-DNS policy, threat intelligence, analytics, and ecosystem integrations. It is often abbreviated B1TD.
The insertion of false DNS data into a resolver cache so future clients receive an attacker-chosen answer. Defenses include strong transaction matching, source-port randomization, DNSSEC validation, cookies, and hardened bailiwick processing.
A lightweight DNS transaction token carried in an EDNS option to help a server verify that a client can receive traffic at its claimed address. DNS Cookies can reduce spoofed-query abuse and improve transaction matching.
DNS-Based Authentication of Named Entities, a family of mechanisms that uses DNSSEC-protected records to associate services with certificates or public keys. TLSA is the best-known record used by DANE.
A DNS record that points to a resource that no longer exists or is no longer controlled by the intended owner. If another party can claim the target service, the condition can enable subdomain takeover.
Identification or classification of a client device based on the DHCP options it requests, sends, or orders. Fingerprints can support inventory, policy, NAC, and anomaly detection, but are not a strong identity mechanism.
A Layer 2 security feature that classifies switch ports as trusted or untrusted, permits legitimate DHCP server traffic only from trusted paths, and builds a binding table from observed leases. The table can support Dynamic ARP Inspection and IP Source Guard.
An attack or fault in which many fake client identities consume the available address pool, preventing legitimate clients from obtaining leases. Rate limits, DHCP snooping, port security, and monitoring help mitigate it.
A denial-of-service technique in which an attacker sends small spoofed queries that trigger larger DNS responses toward a victim. Open recursion, large UDP responses, DNSSEC data, and ANY behavior can increase the amplification factor.
Techniques that infer whether a resolver recently looked up a name by observing its cache behavior or TTL. Restricting recursion and minimizing information leakage can reduce exposure.
An EDNS option that carries client and server cookies to improve transaction assurance and reduce off-path spoofing and reflection abuse without establishing a full session.
A policy enforcement layer that blocks, redirects, or otherwise controls DNS resolution based on domain intelligence, client identity, category, or behavior. RPZ is a common standards-based policy distribution mechanism.
Unauthorized alteration or interception of DNS behavior so users receive attacker-selected or policy-selected results. It can occur at registrars, authoritative servers, resolvers, endpoints, routers, or network interception points.
An attack in which a domain's answers change so browser-originated traffic is redirected from an attacker-controlled host to an internal or local address. Resolver protections can block suspicious private or loopback answers for external names.
An authoritative-server defense that limits repeated similar responses, especially to spoofable UDP queries, to reduce participation in reflection attacks. Implementations usually allow some responses and may trigger truncation.
The malicious creation of many subdomains beneath a legitimately registered domain, often after account compromise, to host phishing, malware, or command-and-control infrastructure. The parent domain can initially appear reputable.
A controlled DNS response that directs prohibited or suspicious names to an analysis, notification, or non-routable destination. Sinkholes can disrupt malware while generating telemetry about affected clients.
The delivery of a forged DNS response intended to be accepted as legitimate. It can target a stub, recursive resolver, application, or network path.
The encoding of data or command traffic inside DNS labels, record data, or query patterns to bypass normal channels. Detection often examines label length, entropy, query volume, record types, and destination reputation.
A random-subdomain denial-of-service attack that sends many queries for unique nonexistent names, forcing recursive and authoritative servers to do repeated work while bypassing positive cache reuse.
An algorithm used to produce many candidate domain names, often so malware can locate command-and-control infrastructure despite takedowns. DGA domains may show unusual entropy, length, timing, and NXDOMAIN patterns.
Abuse in which an attacker compromises control of a legitimate domain and creates unauthorized subdomains for malicious activity. It can evade reputation systems that score only the parent domain.
The EDNS option used to transport DNS Cookies between client and server. It helps verify return reachability and harden UDP exchanges against spoofing.
Network filtering that blocks packets with invalid or unauthorized source addresses from leaving a network. It is a major defense against source-address spoofing used in DNS reflection attacks.
Rapidly changing DNS address records that map a malicious domain to many compromised hosts, often with low TTLs and distributed name servers. It increases resilience for phishing, malware, or proxy infrastructure.
Forward-confirmed reverse DNS, a check in which an address resolves to a PTR name and that name resolves back to the original address. It can be a useful signal but is not proof of identity or authorization.
A pattern of observable behavior used to infer device type, software, or activity. DHCP option order, DNS query patterns, EDNS support, and TTL behavior can contribute to a fingerprint.
A method that uses Generic Security Service mechanisms, commonly Kerberos, to authenticate DNS dynamic updates with TSIG-style transaction protection. It underpins secure dynamic update in many Active Directory environments.
Filtering traffic entering a network based on whether the source address is plausible and authorized for that path. It helps stop spoofing and protects services from malformed or unexpected traffic.
A switch feature that permits IP traffic on an access port only when it matches trusted bindings, often learned through DHCP snooping or configured statically. It helps block source-address spoofing.
A ticket-based authentication protocol widely used by Active Directory. DNS secure dynamic updates can use Kerberos through GSS-TSIG.
An address that is invalid or unexpected in a particular routing context, such as a loopback or private source arriving from the public Internet. The classification depends on interface, direction, and policy.
Network Access Control, a system that evaluates device or user identity and posture before or during network access. NAC platforms often consume DHCP bindings, DNS telemetry, and IPAM context.
A route that discards matching traffic, often used for emergency mitigation or to make sinkhole destinations unreachable. It operates at IP routing rather than DNS policy.
Replacement of a legitimate NXDOMAIN response with a redirect, search page, advertisement, or other synthesized answer. It can break DNSSEC, application assumptions, and diagnostic accuracy.
A recursive resolver that accepts queries from arbitrary Internet clients. Open resolvers are vulnerable to abuse for reflection attacks, policy bypass, and unauthorized resource consumption.
The DHCP Authentication option. Deployment is limited, and network-layer controls such as DHCP snooping are more common in enterprise access networks.
A system that collects and indexes observed DNS query or response data over time without actively probing every name. It supports investigations, threat intelligence, asset discovery, and historical correlation.
A recursive DNS service that uses threat intelligence and policy to block or redirect access to malicious domains while producing security telemetry. It can be delivered on premises, in cloud, or as a hybrid service.
A denial-of-service technique that generates many unique labels beneath a target domain, defeating positive caching and forcing repeated authoritative work. It is also called DNS water torture.
Role-Based Access Control, which grants permissions according to job roles rather than individually. DDI RBAC should separate read, change, approval, key management, and platform-administration duties.
A registry-level protection that prevents selected domain changes until an out-of-band unlock process is completed. It reduces the risk of unauthorized transfer or delegation change.
A DNS zone format and resolver policy mechanism used to distribute rules for blocking, redirecting, or otherwise modifying answers based on queried names, answer addresses, name servers, or client context.
A server technique that limits repeated similar responses to reduce reflection and amplification abuse. It is commonly abbreviated RRL.
Authentication controls that adjust requirements based on context such as device, network, behavior, location, or operation sensitivity. DDI management changes involving DNSSEC keys or global configuration may justify stronger controls.
Abbreviation for Response Policy Zone. It is used by recursive resolvers to apply distributed DNS response policies.
Common abbreviation for DNS Response Rate Limiting. It reduces the volume of repeated spoofable responses while trying to preserve legitimate service.
Source Address Validation Improvement, a family of mechanisms that binds IP source addresses to attachment points to reduce spoofing. SAVI can use DHCP, Neighbor Discovery, or other control-plane evidence.
A DNS UPDATE process authenticated and authorized so only approved clients or services can change records. Common mechanisms include TSIG, GSS-TSIG, SIG(0), and platform identity controls.
The set of security tools and controls that consume or influence DDI data, including SIEM, SOAR, NAC, firewalls, EDR, threat intelligence, protective DNS, and asset inventory.
A controlled destination to which malicious or unwanted traffic is redirected for blocking, observation, or remediation. DNS sinkholes use policy answers to direct clients there.
Use of unpredictable UDP source ports in recursive DNS queries to increase the entropy an off-path attacker must guess when forging a response.
Verification that a packet's source address is legitimate for the interface, route, binding, or customer from which it arrived. Techniques include ACLs, uRPF, DHCP snooping bindings, SAVI, and provider filtering.
An attack in which a DNS record points to a deprovisioned third-party resource that an attacker can claim. Removing dangling records and validating external targets reduces risk.
Information about malicious domains, addresses, infrastructure, campaigns, and behavior used to support detection or blocking. DNS security systems must manage confidence, freshness, false positives, and policy exceptions.
A 16-bit identifier used to match a DNS response to its query. UDP security also relies on source port, addresses, question content, cookies, and other transaction checks.
A shared-secret mechanism that authenticates DNS messages and protects integrity and replay context. It is commonly used for zone transfers, NOTIFY, and dynamic updates between trusted systems.
The common abbreviation for Transaction Signature, a shared-secret authentication mechanism for DNS messages. Current TSIG specification is RFC 8945.
Unicast Reverse Path Forwarding, a source-validation technique that checks whether the routing table has an acceptable return path for a packet's source. Strict, loose, and feasible-path modes have different multihoming tradeoffs.
A restricted network or destination set to which users are redirected until a condition is met, such as authentication, payment, or remediation. DNS redirection can be one component.
A common shortened name for DNS water torture, the random-subdomain attack that forces repeated cache misses and authoritative queries.
A TLS certificate containing a wildcard DNS name such as *.example.com. It normally matches one label at that position and does not replace DNS wildcard behavior.
A security model that avoids implicit trust based solely on network location and continuously evaluates identity, device, policy, and context. For DDI management, it supports strong authentication, least privilege, segmentation, and detailed audit.
Discovery of many or all names in a zone through transfers, NSEC walking, certificate data, search engines, logs, or other sources. DNSSEC with NSEC can make systematic walking easier.
Systematic enumeration of names in a DNSSEC-signed zone by following NSEC records or analyzing NSEC3 under favorable conditions. NSEC3 increases cost but does not guarantee confidentiality.