DNSSEC and SERVFAIL: Find the Cause of Resolution Failure
Diagnose SERVFAIL using detailed DNS errors, the DS/DNSKEY chain and signatures, then verify the repair with DNSSEC validation enabled.
DNS TTL: Investigate a Change of IP Address
Reconstruct DNS address changes using dated responses, caches and network views, without confusing TTL with the lifetime of a threat.
NXDOMAIN: Diagnose a DNS Security Anomaly
Separate nonexistent names, negative caching, filtering and suspicious activity before treating NXDOMAIN errors as a security incident.
CNAME Cloaking: Investigate a Third-Party Subdomain
Trace CNAME records, identify the provider, and inspect transmitted cookies before deciding whether a subdomain should remain authorized.
SPF Permerror: Fix the DNS Lookup Limit
Trace SPF dependencies, distinguish permerror from fail, and reduce DNS lookups while testing every sending service.
Blocklists for Operational Threat Prevention: Test and Roll Back
Use /app/blocklists to select, test, deploy, measure, and safely reverse IP or domain prevention controls.
Subdomain Takeover: Find Dangling DNS First
Prevent subdomain takeover by finding dangling DNS records, linking names to cloud owners, monitoring certificates, and fixing decommissioning order.
Domain Shadowing: Detect Compromised DNS at Scale
Detect domain shadowing by monitoring DNS changes, certificate issuance, subdomain behavior, account security, and infrastructure relationships.
DNS over HTTPS Security: Detect DoH Abuse
Secure DNS over HTTPS without losing visibility: govern resolvers, detect bypass attempts, correlate endpoint telemetry, and preserve user privacy.
DGA Detection: Find Algorithmically Generated Domains
Detect domain generation algorithms with lexical, DNS, endpoint, and reputation signals while controlling false positives in production.
Fast-Flux DNS: Detect Rotating Attack Infrastructure
Learn how to detect fast-flux DNS using TTL, passive DNS, ASN diversity, reputation signals, and a repeatable SOC investigation workflow.