DNS spoofing
The delivery of a forged DNS response intended to be accepted as legitimate. It can target a stub, recursive resolver, application, or network path.
Read definitionCategory glossary
Browse the glossarySecurity glossary — page 2
72 definitions associated with Security.
Browse Security definitions
72 matching terms
Page 2 of 3DNS tunneling
The encoding of data or command traffic inside DNS labels, record data, or query patterns to bypass normal channels. Detection often examines label length, entropy, query volume, record types, and destination reputation.
Read definitionDNS water torture
A random-subdomain denial-of-service attack that sends many queries for unique nonexistent names, forcing recursive and authoritative servers to do repeated work while bypassing positive cache reuse.
Read definitionDomain generation algorithm (DGA)
An algorithm used to produce many candidate domain names, often so malware can locate command-and-control infrastructure despite takedowns. DGA domains may show unusual entropy, length, timing, and NXDOMAIN patterns.
Read definitionDomain shadowing
Abuse in which an attacker compromises control of a legitimate domain and creates unauthorized subdomains for malicious activity. It can evade reputation systems that score only the parent domain.
Read definitionEDNS Cookie option
The EDNS option used to transport DNS Cookies between client and server. It helps verify return reachability and harden UDP exchanges against spoofing.
Read definitionEgress filtering
Network filtering that blocks packets with invalid or unauthorized source addresses from leaving a network. It is a major defense against source-address spoofing used in DNS reflection attacks.
Read definitionFast flux
Rapidly changing DNS address records that map a malicious domain to many compromised hosts, often with low TTLs and distributed name servers. It increases resilience for phishing, malware, or proxy infrastructure.
Read definitionFCrDNS
Forward-confirmed reverse DNS, a check in which an address resolves to a PTR name and that name resolves back to the original address. It can be a useful signal but is not proof of identity or authorization.
Read definitionFingerprint
A pattern of observable behavior used to infer device type, software, or activity. DHCP option order, DNS query patterns, EDNS support, and TTL behavior can contribute to a fingerprint.
Read definitionGSS-TSIG
A method that uses Generic Security Service mechanisms, commonly Kerberos, to authenticate DNS dynamic updates with TSIG-style transaction protection. It underpins secure dynamic update in many Active Directory environments.
Read definitionIngress filtering
Filtering traffic entering a network based on whether the source address is plausible and authorized for that path. It helps stop spoofing and protects services from malformed or unexpected traffic.
Read definitionIP Source Guard
A switch feature that permits IP traffic on an access port only when it matches trusted bindings, often learned through DHCP snooping or configured statically. It helps block source-address spoofing.
Read definitionKerberos
A ticket-based authentication protocol widely used by Active Directory. DNS secure dynamic updates can use Kerberos through GSS-TSIG.
Read definitionMartian address
An address that is invalid or unexpected in a particular routing context, such as a loopback or private source arriving from the public Internet. The classification depends on interface, direction, and policy.
Read definitionNAC
Network Access Control, a system that evaluates device or user identity and posture before or during network access. NAC platforms often consume DHCP bindings, DNS telemetry, and IPAM context.
Read definitionNull route
A route that discards matching traffic, often used for emergency mitigation or to make sinkhole destinations unreachable. It operates at IP routing rather than DNS policy.
Read definitionNXDOMAIN hijacking
Replacement of a legitimate NXDOMAIN response with a redirect, search page, advertisement, or other synthesized answer. It can break DNSSEC, application assumptions, and diagnostic accuracy.
Read definitionOpen resolver
A recursive resolver that accepts queries from arbitrary Internet clients. Open resolvers are vulnerable to abuse for reflection attacks, policy bypass, and unauthorized resource consumption.
Read definitionOption 90
The DHCP Authentication option. Deployment is limited, and network-layer controls such as DHCP snooping are more common in enterprise access networks.
Read definitionPassive DNS
A system that collects and indexes observed DNS query or response data over time without actively probing every name. It supports investigations, threat intelligence, asset discovery, and historical correlation.
Read definitionProtective DNS
A recursive DNS service that uses threat intelligence and policy to block or redirect access to malicious domains while producing security telemetry. It can be delivered on premises, in cloud, or as a hybrid service.
Read definitionRandom subdomain attack
A denial-of-service technique that generates many unique labels beneath a target domain, defeating positive caching and forcing repeated authoritative work. It is also called DNS water torture.
Read definitionRBAC
Role-Based Access Control, which grants permissions according to job roles rather than individually. DDI RBAC should separate read, change, approval, key management, and platform-administration duties.
Read definition