Registry lock
A registry-level protection that prevents selected domain changes until an out-of-band unlock process is completed. It reduces the risk of unauthorized transfer or delegation change.
Read definitionCategory glossary
Browse the glossarySecurity glossary — page 3
72 definitions associated with Security.
Browse Security definitions
72 matching terms
Page 3 of 3Response policy zone (RPZ)
A DNS zone format and resolver policy mechanism used to distribute rules for blocking, redirecting, or otherwise modifying answers based on queried names, answer addresses, name servers, or client context.
Read definitionResponse rate limiting
A server technique that limits repeated similar responses to reduce reflection and amplification abuse. It is commonly abbreviated RRL.
Read definitionRisk-based authentication
Authentication controls that adjust requirements based on context such as device, network, behavior, location, or operation sensitivity. DDI management changes involving DNSSEC keys or global configuration may justify stronger controls.
Read definitionRPZ
Abbreviation for Response Policy Zone. It is used by recursive resolvers to apply distributed DNS response policies.
Read definitionRRL
Common abbreviation for DNS Response Rate Limiting. It reduces the volume of repeated spoofable responses while trying to preserve legitimate service.
Read definitionSAVI
Source Address Validation Improvement, a family of mechanisms that binds IP source addresses to attachment points to reduce spoofing. SAVI can use DHCP, Neighbor Discovery, or other control-plane evidence.
Read definitionSecure dynamic update
A DNS UPDATE process authenticated and authorized so only approved clients or services can change records. Common mechanisms include TSIG, GSS-TSIG, SIG(0), and platform identity controls.
Read definitionSecurity ecosystem
The set of security tools and controls that consume or influence DDI data, including SIEM, SOAR, NAC, firewalls, EDR, threat intelligence, protective DNS, and asset inventory.
Read definitionSinkhole
A controlled destination to which malicious or unwanted traffic is redirected for blocking, observation, or remediation. DNS sinkholes use policy answers to direct clients there.
Read definitionSource port randomization
Use of unpredictable UDP source ports in recursive DNS queries to increase the entropy an off-path attacker must guess when forging a response.
Read definitionSource validation
Verification that a packet's source address is legitimate for the interface, route, binding, or customer from which it arrived. Techniques include ACLs, uRPF, DHCP snooping bindings, SAVI, and provider filtering.
Read definitionSubdomain takeover
An attack in which a DNS record points to a deprovisioned third-party resource that an attacker can claim. Removing dangling records and validating external targets reduces risk.
Read definitionThreat intelligence
Information about malicious domains, addresses, infrastructure, campaigns, and behavior used to support detection or blocking. DNS security systems must manage confidence, freshness, false positives, and policy exceptions.
Read definitionTransaction ID
A 16-bit identifier used to match a DNS response to its query. UDP security also relies on source port, addresses, question content, cookies, and other transaction checks.
Read definitionTransaction signature (TSIG)
A shared-secret mechanism that authenticates DNS messages and protects integrity and replay context. It is commonly used for zone transfers, NOTIFY, and dynamic updates between trusted systems.
Read definitionTSIG
The common abbreviation for Transaction Signature, a shared-secret authentication mechanism for DNS messages. Current TSIG specification is RFC 8945.
Read definitionuRPF
Unicast Reverse Path Forwarding, a source-validation technique that checks whether the routing table has an acceptable return path for a packet's source. Strict, loose, and feasible-path modes have different multihoming tradeoffs.
Read definitionWalled garden
A restricted network or destination set to which users are redirected until a condition is met, such as authentication, payment, or remediation. DNS redirection can be one component.
Read definitionWater torture
A common shortened name for DNS water torture, the random-subdomain attack that forces repeated cache misses and authoritative queries.
Read definitionWildcard certificate
A TLS certificate containing a wildcard DNS name such as *.example.com. It normally matches one label at that position and does not replace DNS wildcard behavior.
Read definitionZero trust
A security model that avoids implicit trust based solely on network location and continuously evaluates identity, device, policy, and context. For DDI management, it supports strong authentication, least privilege, segmentation, and detailed audit.
Read definitionZone enumeration
Discovery of many or all names in a zone through transfers, NSEC walking, certificate data, search engines, logs, or other sources. DNSSEC with NSEC can make systematic walking easier.
Read definitionZone walking
Systematic enumeration of names in a DNSSEC-signed zone by following NSEC records or analyzing NSEC3 under favorable conditions. NSEC3 increases cost but does not guarantee confidentiality.
Read definition