Split-horizon DNS forgot the external TXT record needed for domain ownership,...

시나리오

Internal testing passes, but the control plane …

단서

구독하면 이어서 볼 수 있어요

이 문제의 전체 시나리오와 점검 체크리스트, 복구 순서, 모범 풀이는 Pro 구독에서 열립니다.

구독 안내 보기

먼저 볼 것

점검 체크리스트

복구와 재발 방지

같이 보면 좋은 질문

현장에서 본 비슷한 케이스

다음으로 이어서 보기 좋은 문제

Security Advanced

A newly blocked domain remains reachable through stale resolver cache state during a failover rehearsal

The control is correct now while caches preserve yesterday's trust decision. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.

17 min

View problem

Security Intermediate

A DNS-based security control blocks new lookups while stale resolver cache still serves the previous answer for the same host during a failover rehearsal

The control is correct now and one cache layer still trusts yesterday. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.

17 min

View problem

Security Advanced

A DNSSEC-signed public zone validates while the internal split-horizon copy still serves unsigned child records during a failover rehearsal

External trust is healthy and internal trust assumptions no longer match it. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.

18 min

View problem

Security Intermediate

A DNS sinkhole activates for new queries while one recursive resolver keeps serving stale ECS- or geo-influenced answers from a previous policy epoch during a staged decommission

A DNS sinkhole activates for new queries while one recursive resolver keeps serving stale ECS- or geo-influenced answers from a previous policy epoch during a staged d...

16 min

View problem

Split-horizon DNS forgot the external TXT record needed for domain ownership, and the SSO cutover never verifies on the public side

A newly blocked domain remains reachable through stale resolver cache state during a failover rehearsal

A DNS-based security control blocks new lookups while stale resolver cache still serves the previous answer for the same host during a failover rehearsal

A DNSSEC-signed public zone validates while the internal split-horizon copy still serves unsigned child records during a failover rehearsal

A DNS sinkhole activates for new queries while one recursive resolver keeps serving stale ECS- or geo-influenced answers from a previous policy epoch during a staged decommission