DNS UPDATE (Dynamic DNS Update)
DNS UPDATE lets an authorized client add, delete or change individual records in a zone directly, without editing and reloading a zone file, and is normally restricted with TSIG or SIG(0) authentication. AdminKit's DNS Lookup tool shows a record's current live value, the same value an authorized or unauthorized Update actually changes.
By AdminKit team, Netbase JSC · Updated
DNS UPDATE, defined in RFC 2136, is a DNS opcode that lets a client add, delete or replace individual resource records in an authoritative zone over the network, instead of an administrator editing a zone file and reloading the server by hand — useful for systems that need to publish their own current record, such as dynamic DNS clients or automated certificate issuance. Because an unauthenticated Update request would let anyone rewrite a zone’s records, RFC 3007 requires every secure Update message to carry a TSIG or SIG(0) signature the receiving server can verify against a shared key or public key before applying the change, separate from DNSSEC’s own signing of the resulting zone data. A nameserver that accepts Updates without this authentication, or with a weak or shared key, is effectively letting any client with network access silently rewrite its records — a quieter, more targeted risk than a full zone transfer.