Browse by Section
All Articles
33 articlesNo articles match your search criteria.
Coming Soon
Articles for this section are in development.
Stub Resolvers: The DNS You Actually Use
An explanation of stub resolvers, the DNS components that run on endpoints and decide how name resolution behaves before any query leaves the device.
Why DNS Behavior Differs by Operating System
An explanation of how and why DNS resolution behavior varies across macOS, Windows, Linux, and mobile operating systems.
mDNS, LLMNR, and Local Name Resolution
Why local name resolution protocols exist, how they work, and how they interact with conventional DNS.
DNS Search Domains and Suffix Expansion
How operating systems modify and expand names before sending DNS queries, and why this behavior often surprises engineers.
VPNs, Split DNS, and Surprising Resolution Paths
How DNS behaves unexpectedly when traffic is split across multiple networks or trust boundaries, and why VPNs change where DNS questions are sent.
How DNS Filtering Works
A conceptual explanation of how DNS filtering fits into the DNS resolution process, and what is actually happening when a domain is blocked.
DNS Filtering for Acceptable Use Policies
How DNS filtering turns acceptable use rules into domain-level policy decisions, including category controls, exceptions, identity context, and the boundaries of DNS-based enforcement.
Protective DNS and Compliance: Where DNS Fits in Security Frameworks
How current security guidance treats protective DNS, including explicit DNS filtering safeguards, outcome-based frameworks, federal requirements, and the evidence DNS can contribute to compliance programs.
How Domains Are Classified and Categorized
How domain classification systems combine lexical signals, website content, DNS and infrastructure data, threat intelligence, and newer reasoning models to decide what a domain represents and whether it poses risk.
DNS 101: Introduction to the Domain Name System
An introduction to DNS explaining what problem it solves, why it is designed as a distributed system, and how its core roles fit together.
How DNS Resolution Works (At a High Level)
A conceptual walk through how a domain name becomes an answer, focusing on the resolution flow rather than individual record types.
Domain Names, Labels, and the DNS Namespace
An explanation of how domain names are structured, how labels function, and how the hierarchical DNS namespace enables delegation and resolution.
DNS Zones and Delegation
How the DNS namespace is divided into zones, how authority is delegated, and why zone boundaries shape control, caching, and failure behavior.
DNS Caching and TTL: What Resolvers Remember and for How Long
How DNS caching works, what a TTL actually controls, why positive and negative answers expire on different clocks, and why changes spread unevenly.
Recursive vs Authoritative DNS: Who Answers What, and Why
An explanation of the two major DNS server roles, how they interact during resolution, and why the separation matters operationally.
Anycast and DNS: Why the Same IP Exists Everywhere
How IP anycast works, why DNS infrastructure relies on it, and what it means operationally when the same address exists in many places at once.
DNS at Scale: Latency, Load, and Failure Domains
How DNS behavior changes when systems grow large, and why latency, load, and failure domains dominate real-world design.
Common DNS Failure Modes and What They Look Like
Common DNS failure modes including SERVFAIL, timeouts, stale data, and partial outages, with guidance on what they mean and where they originate.
Change Management in DNS
Why DNS changes that seem simple often propagate slowly, inconsistently, or unexpectedly in real systems.
Why Attackers Use DNS
An architectural explanation of why DNS is frequently abused, rooted in how the protocol is designed and operated.
DNS Tunneling: How DNS Can Carry Data
How DNS tunneling repurposes ordinary queries and responses to carry data, how resolvers and caching shape the channel, and what defenders can observe.
Domain Generation Algorithms: How Malware Uses DNS to Find Infrastructure
How domain generation algorithms let malware and its infrastructure derive the same changing domain names, and what failed lookups reveal in DNS telemetry.
Fast Flux DNS: How Rapid Address Changes Obscure Infrastructure
How fast flux uses rapidly changing DNS answers and short TTLs to hide infrastructure, and why telling it apart from legitimate DNS takes time-series evidence.
DNS Cache Poisoning: How Forged Answers Enter Resolver Caches
How DNS cache poisoning works, why forged responses must match outstanding resolver transactions, and how modern DNS defenses reduce the risk.
DNSSEC: How DNS Answers Gain Cryptographic Authentication
How DNSSEC signs DNS data, builds a chain of trust through the DNS hierarchy, validates negative answers, and defines the limits of that authentication.
Dangling DNS Records: How Subdomain Takeover Becomes Possible
How stale DNS references to deleted third-party resources can create subdomain takeover risk, and why exploitability depends on provider ownership rules.
DNS Rebinding: How DNS Can Cross Browser Trust Boundaries
How DNS rebinding changes the address behind a stable hostname, why that interacts with browser same-origin rules, and which controls limit the attack.
Encrypted DNS: Privacy vs. Anonymity
How encrypted DNS changes who can observe DNS traffic, why encryption doesn't make queries anonymous, and where the privacy boundaries actually sit.
DNS over TLS: How DoT Encrypts Resolver Traffic
How DNS over TLS carries ordinary DNS messages through a dedicated TLS connection: port 853, authentication, connection reuse, and privacy profiles.
DNS over HTTPS: How DoH Changes the DNS Transport
How DNS over HTTPS carries ordinary DNS messages through HTTPS, what changes for clients and networks, and what stays DNS all the way through.
DNS over QUIC (DoQ): Encrypted DNS Without TCP
How DNS over QUIC carries encrypted DNS over QUIC, what changes compared with DNS over TLS, and why independent streams matter for DNS transport behavior.
Oblivious DNS over HTTPS (ODoH): Separating Client Identity from DNS Queries
How Oblivious DNS over HTTPS separates the client network address from query contents by placing a non-colluding proxy between client and target.
Transparent DNS Proxies and Hidden DNS Interception
How networks transparently redirect unencrypted DNS, why the term DNS proxy is ambiguous, and what interception means for resolver choice and troubleshooting.
Recently Updated
Stub Resolvers: The DNS You Actually Use
An explanation of stub resolvers, the DNS components that run on endpoints and decide how name resolution behaves before any query leaves the device.
DNS Search Domains and Suffix Expansion
How operating systems modify and expand names before sending DNS queries, and why this behavior often surprises engineers.
VPNs, Split DNS, and Surprising Resolution Paths
How DNS behaves unexpectedly when traffic is split across multiple networks or trust boundaries, and why VPNs change where DNS questions are sent.
How DNS Filtering Works
A conceptual explanation of how DNS filtering fits into the DNS resolution process, and what is actually happening when a domain is blocked.