Domain Name System dynamic update

Template:TOC-right Today's Internet Protocol networks, for a variety of reasons, can have rapid, fine-grained changes in name-to-address mapping, and the Domain Name System dynamic update technology was introduced to cope with this need. Dynamic update is an additional security vulnerability, and must be implemented with Domain Name System security (DNSSEC) in mind.

The original intent of the Domain Name System was to replace a completely static file of address-to-name mappings called hosts.txt. While the single file was not scalable and needed to be replaced by the distributed database that is the basic DNS architecture, server in that architecture still tended to be updated in a deliberate, batch-oriented procedure.

Both the rate of appearance of new hosts, as well as operational techniques that temporarily pair addresses and names, it was necessary to expand DNS so it could be updated not only with entire files (i.e., zone transfer), but with transient, dynamically acquired addresses. Such an update is an invitation to attack unless secured, so dynamic DNS update should always be associated with a specific secure update mechanism, within the DNS security architecture.

Sources of Dynamic Update

The most common source of dynamic updates is the Dynamic Host Configuration Protocol (DHCP), used on local area networks but also providing the mapping service, via a proxy, to other dynamic address assignments, such as the PPP Internet Protocol Control Protocol (IPCP) of the Point-to-Point Protocol.

A major new area of dynamic update comes from the Internet Protocol version 6 Stateless Address Configuration (SLAAC) mechanism.