DAD
Duplicate Address Detection, the Neighbor Discovery procedure a node uses before assigning an IPv6 unicast address to an interface. It helps detect another node already using the same address on the link.
Read definitionAlphabetical glossary
D glossary terms
100 definitions beginning with D.
100 terms
DANE
DNS-Based Authentication of Named Entities, a family of mechanisms that uses DNSSEC-protected records to associate services with certificates or public keys. TLSA is the best-known record used by DANE.
Read definitionDangling DNS record
A DNS record that points to a resource that no longer exists or is no longer controlled by the intended owner. If another party can claim the target service, the condition can enable subdomain takeover.
Read definitionData plane
The runtime components that directly answer DNS queries, allocate DHCP leases, or forward traffic. Data-plane availability can remain intact even when the management or control plane is temporarily unavailable, depending on design.
Read definitionDDI
The integrated management and delivery of Domain Name System, Dynamic Host Configuration Protocol, and IP Address Management. A DDI platform connects naming, address assignment, inventory, policy, automation, and operational visibility.
Read definitionDDNS
Dynamic DNS, the controlled creation, modification, or deletion of DNS records without manually editing a zone file. DHCP servers and clients commonly use DNS UPDATE to register address and pointer records.
Read definitionDDR
Discovery of Designated Resolvers, a mechanism that lets clients learn encrypted DNS services associated with an existing resolver. It can upgrade local DNS service from plaintext to an authenticated encrypted transport.
Read definitionDead peer detection
A mechanism used to determine that a partner, server, or network path is no longer functioning. DDI products may use heartbeats, protocol messages, routing state, or interface status to trigger failover.
Read definitionDecline
A client message indicating that an offered or assigned address appears to be in use. The server normally marks the address unavailable for investigation or later retry.
Read definitionDelegated prefix
An IPv6 prefix assigned to a requesting router for use on downstream links. The router can subnet the delegated prefix without receiving individual address leases for every downstream host.
Read definitionDelegating router
A DHCPv6 server function that selects and delegates IPv6 prefixes to requesting routers. It maintains prefix bindings and lifetimes in much the same way address leases are maintained.
Read definitionDelegation
The relationship created when a parent zone publishes NS records that identify the authoritative servers for a child zone. A delegation may also require glue address records in the parent.
Read definitionDelegation signer (DS) record
A record in a parent zone that authenticates a DNSKEY in the child zone. It forms the secure link between parent and child in the DNSSEC chain of trust.
Read definitionDelegation-centric zone
A zone whose main purpose is publishing delegations rather than ordinary endpoint data, such as a large parent zone operated by a registry. Operational choices for signing, transfers, and automation may differ from host-oriented zones.
Read definitionDenial of existence
Cryptographic proof that a queried name or record type does not exist in a signed zone. NSEC and NSEC3 are the classic mechanisms used to provide the proof.
Read definitionDHCID record
A DNS record that stores a digest representing a DHCP client identity and name association. It helps DHCP servers detect ownership conflicts during coordinated dynamic DNS updates.
Read definitionDHCP
The Dynamic Host Configuration Protocol automatically supplies hosts with IP addressing and other configuration. DHCPv4 and DHCPv6 are separate protocols with different message formats, transports, identifiers, and state models.
Read definitionDHCP client
A host or device that requests configuration from a DHCP server. The client can identify itself through a MAC address, client identifier, DUID, IAID, vendor class, or other fields depending on protocol version.
Read definitionDHCP failover
A protocol or product feature that allows two DHCP servers to coordinate lease ownership and continue service after a partner failure. DHCPv4 failover behavior and DHCPv6 failover use different standards and implementations.
Read definitionDHCP fingerprinting
Identification or classification of a client device based on the DHCP options it requests, sends, or orders. Fingerprints can support inventory, policy, NAC, and anomaly detection, but are not a strong identity mechanism.
Read definitionDHCP lease
A time-limited authorization for a client to use an address or prefix together with associated configuration. The client renews before expiration or stops using the resource when the lease is no longer valid.
Read definitionDHCP message type
A code identifying the purpose of a DHCP message, such as DISCOVER, OFFER, REQUEST, ACK, SOLICIT, ADVERTISE, or REPLY. DHCPv4 message type is carried in option 53, while DHCPv6 begins with a native message-type field.
Read definitionDHCP option
A typed field that carries configuration or protocol information in a DHCP exchange. Options can provide DNS servers, routes, boot parameters, identities, relay metadata, domain search lists, or vendor data.
Read definitionDHCP policy
A rule that matches client, relay, network, time, or option attributes and applies behavior such as a pool, option set, lease time, or deny action. Policy syntax and precedence are product-specific.
Read definitionDHCP relay agent
A router, switch, firewall, or server function that forwards DHCP messages between clients and servers on different links. It adds link-identifying information so the server can select the correct subnet or policy.
Read definitionDHCP reservation
A configuration that consistently assigns a chosen address to a known client. Matching can be based on client identifier, MAC address, DUID, or another product-supported key.
Read definitionDHCP scope
A defined IPv4 subnet and its allocatable address range, exclusions, reservations, lease duration, and options. Some products instead use terms such as network, range, pool, or subnet.
Read definitionDHCP server
A service that selects configuration for clients, maintains bindings, and responds to DHCP messages. It can also coordinate DNS updates, policy evaluation, failover, and lease reporting.
Read definitionDHCP snooping
A Layer 2 security feature that classifies switch ports as trusted or untrusted, permits legitimate DHCP server traffic only from trusted paths, and builds a binding table from observed leases. The table can support Dynamic ARP Inspection and IP Source Guard.
Read definitionDHCP starvation
An attack or fault in which many fake client identities consume the available address pool, preventing legitimate clients from obtaining leases. Rate limits, DHCP snooping, port security, and monitoring help mitigate it.
Read definitionDHCPACK
A server message confirming the offered or renewed IPv4 configuration. The client can enter or remain in the BOUND state after validating and applying the configuration.
Read definitionDHCPDECLINE
A client message reporting that the offered address appears to be in use. The server normally marks the address as conflicted or abandoned.
Read definitionDHCPDISCOVER
The initial client message used to locate DHCP servers and request configuration. It is often broadcast because the client does not yet have a usable IPv4 address.
Read definitionDHCPFORCERENEW
A server-initiated message asking a client to begin lease renewal so configuration can be refreshed. Authentication or trusted network controls are important because the message can otherwise be abused.
Read definitionDHCPINFORM
A message sent by a client that already has an IPv4 address but wants additional local configuration options. The server replies with DHCPACK without allocating a new address lease.
Read definitionDHCPNAK
A negative acknowledgement indicating that the client's requested or remembered IPv4 configuration is not valid for the current network or cannot be honored. The client normally returns to initial configuration.
Read definitionDHCPOFFER
A server proposal containing an available IPv4 address and configuration. A client can receive multiple offers and select one by sending DHCPREQUEST.
Read definitionDHCPRELEASE
A client message telling the server that it is voluntarily giving up its lease. Because release is not guaranteed during shutdown or disconnect, servers must still rely on lease expiration.
Read definitionDHCPREQUEST
A client message used to select an offer, confirm a remembered address, renew a lease, or rebind. Context and included options tell the server which use applies.
Read definitionDHCPv4
The DHCP protocol used to configure IPv4 hosts. It uses UDP ports 67 and 68 and commonly follows the Discover, Offer, Request, Acknowledge sequence.
Read definitionDHCPv4-over-DHCPv6
A mechanism that carries DHCPv4 messages through DHCPv6 infrastructure, useful in some IPv6-oriented access networks. It is identified by DHCPv6 DHCPV4-QUERY and DHCPV4-RESPONSE messages.
Read definitionDHCPv6
The DHCP protocol for IPv6. It uses UDP ports 546 and 547, DUID-based identities, identity associations, and messages such as SOLICIT, ADVERTISE, REQUEST, and REPLY.
Read definitionDKIM
DomainKeys Identified Mail, an email-authentication method that adds a cryptographic signature to a message. The public verification key is published in a DNS TXT record beneath a selector-specific name.
Read definitionDKIM selector
A label identifying which DKIM public key should be retrieved for a signed email. The lookup name uses selector._domainkey followed by the signing domain.
Read definitionDMARC
Domain-based Message Authentication, Reporting, and Conformance, a policy framework that evaluates SPF and DKIM alignment and publishes policy and reporting addresses in DNS TXT records.
Read definitionDNAME record
A Delegation Name record redirects an entire subtree of names to another subtree, unlike CNAME which aliases a single owner name. Resolvers synthesize a CNAME-like result for the queried descendant.
Read definitionDNR
Discovery of Network-designated Resolvers, DHCP and IPv6 Router Advertisement options that tell clients about encrypted DNS resolvers selected by the network. It complements DDR, which discovers encrypted service from an existing resolver.
Read definitionDNS
The Domain Name System, a distributed hierarchical database and protocol used to map names to resource records. It supports far more than address lookup, including service discovery, email routing, delegation, policy, and security data.
Read definitionDNS amplification
A denial-of-service technique in which an attacker sends small spoofed queries that trigger larger DNS responses toward a victim. Open recursion, large UDP responses, DNSSEC data, and ANY behavior can increase the amplification factor.
Read definitionDNS anomaly
A query or response pattern that differs from expected behavior, such as sudden NXDOMAIN growth, unusual labels, rare record types, high entropy, or traffic from an unexpected client. An anomaly is a signal, not proof of malicious activity.
Read definitionDNS cache snooping
Techniques that infer whether a resolver recently looked up a name by observing its cache behavior or TTL. Restricting recursion and minimizing information leakage can reduce exposure.
Read definitionDNS class
The CLASS field associated with queries and resource records. IN is the normal Internet class, while other values are used for historical, diagnostic, or specialized purposes.
Read definitionDNS Cookies
An EDNS option that carries client and server cookies to improve transaction assurance and reduce off-path spoofing and reflection abuse without establishing a full session.
Read definitionDNS firewall
A policy enforcement layer that blocks, redirects, or otherwise controls DNS resolution based on domain intelligence, client identity, category, or behavior. RPZ is a common standards-based policy distribution mechanism.
Read definitionDNS flag day
A coordinated industry event after which participating DNS software stops accommodating a legacy or non-compliant behavior. The goal is to accelerate protocol hygiene by changing defaults at the same time.
Read definitionDNS forwarding proxy
A DNS intermediary that accepts client queries and sends them to another resolver, sometimes adding policy, caching, encryption, or protocol translation. Its exact recursion and validation behavior should be documented.
Read definitionDNS hijacking
Unauthorized alteration or interception of DNS behavior so users receive attacker-selected or policy-selected results. It can occur at registrars, authoritative servers, resolvers, endpoints, routers, or network interception points.
Read definitionDNS message
The protocol unit containing a DNS header and question, answer, authority, and additional sections. Queries and responses use the same overall format with flags indicating purpose and status.
Read definitionDNS name compression
A wire-format technique that replaces repeated domain-name suffixes with pointers to earlier positions in a DNS message. Incorrect compression processing has historically caused implementation vulnerabilities.
Read definitionDNS over CoAP (DoC)
A mapping of DNS messages to the Constrained Application Protocol for constrained environments. Security is provided by the applicable CoAP security mechanisms.
Read definitionDNS over HTTPS (DoH)
DNS carried in HTTPS, typically over TCP port 443. DoH provides transport confidentiality and server authentication while sharing web infrastructure and policy considerations.
Read definitionDNS over QUIC (DoQ)
DNS carried over QUIC with encrypted, multiplexed transactions and no TCP head-of-line blocking between streams. The default port is 853.
Read definitionDNS over TLS (DoT)
DNS carried over a dedicated TLS connection, normally TCP port 853. It encrypts resolver traffic and authenticates the selected resolver when certificates are validated.
Read definitionDNS policy
Rules that influence how queries are answered or processed based on name, type, client, time, geography, health, or security intelligence. Examples include response policy zones, views, traffic steering, and filtering.
Read definitionDNS rebinding
An attack in which a domain's answers change so browser-originated traffic is redirected from an attacker-controlled host to an internal or local address. Resolver protections can block suspicious private or loopback answers for external names.
Read definitionDNS response rate limiting (RRL)
An authoritative-server defense that limits repeated similar responses, especially to spoofable UDP queries, to reduce participation in reflection attacks. Implementations usually allow some responses and may trigger truncation.
Read definitionDNS search list
An ordered set of suffixes a host may append to a relative name during local resolution. DHCP options 119 and 24 can distribute search lists for IPv4 and IPv6 respectively.
Read definitionDNS Service Discovery (DNS-SD)
A naming convention and query method for discovering service instances and their parameters using PTR, SRV, and TXT records. It is often paired with multicast DNS on local networks.
Read definitionDNS shadowing
The malicious creation of many subdomains beneath a legitimately registered domain, often after account compromise, to host phishing, malware, or command-and-control infrastructure. The parent domain can initially appear reputable.
Read definitionDNS sinkhole
A controlled DNS response that directs prohibited or suspicious names to an analysis, notification, or non-routable destination. Sinkholes can disrupt malware while generating telemetry about affected clients.
Read definitionDNS spoofing
The delivery of a forged DNS response intended to be accepted as legitimate. It can target a stub, recursive resolver, application, or network path.
Read definitionDNS Traffic Control (DTC)
An Infoblox NIOS feature for DNS-based traffic steering using health monitors, servers, pools, topology, and load-balanced domain names. It supports GSLB-style responses from authoritative DNS.
Read definitionDNS tunneling
The encoding of data or command traffic inside DNS labels, record data, or query patterns to bypass normal channels. Detection often examines label length, entropy, query volume, record types, and destination reputation.
Read definitionDNS UPDATE
The standardized DNS operation that adds, deletes, or changes records in a zone. Updates can use prerequisites and are normally authenticated with TSIG, SIG(0), GSS-TSIG, or platform access controls.
Read definitionDNS view
A server-side configuration that provides different DNS data or behavior to different clients, often based on source network, interface, or identity. Views are commonly used for split DNS and overlapping namespaces.
Read definitionDNS water torture
A random-subdomain denial-of-service attack that sends many queries for unique nonexistent names, forcing recursive and authoritative servers to do repeated work while bypassing positive cache reuse.
Read definitionDNS zone
A coherently managed portion of the DNS namespace served as authoritative data. A zone begins at its apex and ends at delegated child-zone cuts.
Read definitionDNS64
A resolver function that synthesizes AAAA records from IPv4 A records using a configured IPv6 prefix, allowing IPv6-only clients to reach IPv4 services through NAT64.
Read definitionDNSKEY record
A record containing a public key used to verify DNSSEC signatures made by the corresponding private key. DNSKEYs commonly serve as zone-signing or key-signing keys based on operational role.
Read definitionDNSSEC
DNS Security Extensions add origin authentication and integrity protection to DNS data through digital signatures and authenticated denial of existence. DNSSEC does not encrypt queries or responses.
Read definitionDNSSEC validation
The process of verifying DNSSEC signatures and chains of trust from a configured trust anchor. The result is commonly classified as secure, insecure, bogus, or indeterminate.
Read definitiondnstap
A structured binary event stream for recording DNS message and resolver processing data. It provides richer and often more efficient telemetry than plain-text query logs.
Read definitionDO bit
The DNSSEC OK bit in the EDNS OPT record indicates that a requester can receive DNSSEC-related records in the response. It does not by itself request or prove validation.
Read definitionDomain
A node in the DNS namespace together with all names below it. A domain is not necessarily the same as a zone because delegations can divide a domain into separately administered zones.
Read definitionDomain generation algorithm (DGA)
An algorithm used to produce many candidate domain names, often so malware can locate command-and-control infrastructure despite takedowns. DGA domains may show unusual entropy, length, timing, and NXDOMAIN patterns.
Read definitionDomain name
An ordered sequence of DNS labels representing a node in the namespace. In presentation format, labels are separated by dots.
Read definitionDomain shadowing
Abuse in which an attacker compromises control of a legitimate domain and creates unauthorized subdomains for malicious activity. It can evade reputation systems that score only the parent domain.
Read definitionDomain suffix search
The client behavior of appending configured suffixes to a relative name and trying one or more resulting FQDNs. Search behavior varies by operating system and can create information leakage or unexpected lookups.
Read definitionDORA
A mnemonic for the common DHCPv4 address-acquisition exchange: Discover, Offer, Request, Acknowledge. Additional messages and paths exist for renewal, reboot, decline, release, and information-only operation.
Read definitionDS record
A Delegation Signer record in a parent zone contains a digest of a child DNSKEY and identifies the algorithm and digest type. It creates a signed delegation in the chain of trust.
Read definitionDSO
DNS Stateful Operations, a framework for maintaining stateful sessions and exchanging asynchronous DNS-related messages over a persistent transport. It supports capabilities such as DNS Push Notifications.
Read definitionDSYNC record
A DNS record used to publish the location of a service that synchronizes delegation-related data between child and parent. It supports automated delegation maintenance workflows.
Read definitionDTC LBDN
A DTC Load Balanced Domain Name object that links a queried DNS name and record type to DTC pools and selection logic. It is the policy entry point for a DTC-managed answer.
Read definitionDTC pool
A collection of DTC servers or endpoints with load-balancing and health behavior. Pools are associated with an LBDN and may be selected by topology or availability.
Read definitionDTC server
An Infoblox DTC object representing an application endpoint and one or more service addresses or ports. Health monitors determine whether it is eligible for DNS responses.
Read definitionDual stack
Operation of IPv4 and IPv6 on the same host, network, or service. Dual stack eases transition but requires parallel addressing, security, monitoring, and DDI policy.
Read definitionDUID
A DHCP Unique Identifier that identifies a DHCPv6 client or server across interfaces and restarts. Defined types include link-layer plus time, enterprise-based, link-layer only, and UUID-based DUIDs.
Read definitionDynamic allocation
An allocation method that leases an address to a client for a limited time from a pool. The address can be returned and later assigned to another client after release or expiration.
Read definitionDynamic range
The portion of a subnet from which a server may select addresses for ordinary lease allocation. Reservations, fixed addresses, exclusions, and static infrastructure should be planned to avoid overlap.
Read definitionDynamic update
An update made through a protocol or automated process rather than by editing static zone data. In most DNS contexts it refers to RFC 2136 DNS UPDATE.
Read definition