DNS, DHCP and IPAM Glossary
Working definitions of the DNS, DHCP, IPAM and DDI terms network and security teams deal with every day. Search for a term, browse by topic, or work through the A-Z.
Browse by topic
Every definition belongs to one of four subjects. Each group lists the terms it holds, links to the topic page that collects the longer material, and points at the product or solution the subject leads to.
DNS Security
Attack types, filtering, threat intelligence and the controls that sit at the DNS layer.
Network Automation
Automation, orchestration, APIs and the infrastructure patterns behind them.
IP Address Management
Addressing, allocation, IPv4 and IPv6, and the records that depend on them.
DDI
How DNS, DHCP and IPAM work as one system, and what running them together requires.
Most-read definitions
The six entries readers reach most often, kept one click from the index.
DHCP
The protocol that hands a device its IP address and network settings automatically when it joins a network.
DHCP Option
A configuration value delivered with a lease, such as the DNS servers or gateway a client should use.
IPAM
IP address management: planning, allocating and tracking address space across every network you run.
IPv6
The 128-bit addressing scheme that succeeds IPv4, with enough address space to end the scarcity.
DNS
The system that turns the names people type into the IP addresses networks actually route to.
DNS over HTTPS (DoH)
DNS queries carried inside encrypted HTTPS, which protects privacy and hides resolution from network controls.
All terms A-Z
One term, one row, one destination. Where several entries covered the same term they have been merged into the surviving definition, and the retired addresses redirect into it.
[PLACEHOLDER: final term count, once the DNS-port entries are consolidated]
A
- Anycast DNS One IP address announced from many locations, so every query is answered by the nearest healthy server. DDI
C
An attack that plants forged records in a resolver’s cache so users are sent to an address the attacker controls.
A DNS record that points one hostname at another, so a single canonical name carries the address.
The practice of protecting networks, systems and data from unauthorised access, disruption and theft.
D
The unauthorised movement of data out of a network, often hidden inside protocols that firewalls leave open.
DNS, DHCP and IP address management run as one system with a single source of truth behind them.
Visibility into DNS, DHCP and IPAM activity as one dataset, so network behaviour can be seen and explained.
An attack that floods a service with traffic from many sources until real requests can no longer be answered.
The protocol that hands a device its IP address and network settings automatically when it joins a network.
Identifying what a device is from the shape of its DHCP request, before it is granted an address.
The period a device may hold an assigned IP address before it has to renew or release it.
A configuration value delivered with a lease, such as the DNS servers or gateway a client should use.
A switch-level control that drops DHCP responses from any server the network has not authorised.
The system that turns the names people type into the IP addresses networks actually route to.
A denial-of-service technique that uses small spoofed queries to aim large DNS responses at a victim.
Any attack that targets or abuses DNS, from cache poisoning and floods through to tunnelling and hijacking.
A technique that rotates the addresses behind a domain within minutes to keep malicious infrastructure reachable.
Blocking or redirecting queries for domains that policy or threat intelligence marks as unsafe.
A denial-of-service attack that buries a DNS server under more queries than it can answer.
Continuous insight into every query and response, so DNS behaviour can be measured rather than guessed at.
DNS queries carried inside encrypted HTTPS, which protects privacy and hides resolution from network controls.
DNS queries encrypted in their own TLS session on a dedicated port, so resolution stays private and visible to policy.
The port DNS runs on: 53, over UDP for ordinary queries and TCP where the response will not fit.
Also covers Port 53 and UDP or TCP for DNS
The entries in a zone that tell resolvers where a name points, including A, AAAA, CNAME, MX and TXT.
The controls that keep DNS available and stop it being used as an attack or data-exfiltration path.
A resolver answer that sends traffic for a malicious domain to a controlled address instead of the real one.
A TXT record naming the servers allowed to send mail for a domain, so receivers can reject forgeries.
How long a resolver may cache a record before it has to ask the authoritative server again.
Encoding other traffic inside DNS queries and answers to move data past controls that allow DNS through.
A record holding free-form text, used for domain verification, mail policy and similar checks.
Signatures on DNS data that let a resolver prove an answer came from the zone and was not altered.
Domain Generation Algorithm (DGA)
Malware logic that generates domain names in bulk so its command channel is hard to block by name.
Automatic updating of DNS records when a host’s address changes, so names keep resolving without manual edits.
F
G
H
- Hybrid Cloud An estate that runs workloads on-premises and in public cloud, with services expected to work across both. Network Automation
I
Defining and changing infrastructure through version-controlled files rather than by hand.
IP address management: planning, allocating and tracking address space across every network you run.
The 32-bit addressing scheme most networks still run on, with an address space exhausted years ago.
The 128-bit addressing scheme that succeeds IPv4, with enough address space to end the scarcity.
M
- Multicloud Running workloads across more than one cloud provider, each with its own DNS and addressing model. Network Automation
N
Network and security teams working from shared data and shared process instead of separate toolchains.
Driving network changes from code and APIs, against a source of truth the automation can trust.
The ability to explain what a network is doing from the data it already produces.
The controls that protect a network’s traffic, devices and services from attack and misuse.
Dividing a network into zones so a compromise in one of them does not reach the rest.
Network Source of Truth (NSoT)
The authoritative record of what the network contains, which automation reads before it changes anything.
The EU directive raising cybersecurity and incident-reporting obligations for essential and important entities.
P
A historical record of observed DNS resolutions, used to trace the infrastructure behind an attack.
Name resolution kept inside an organisation or a device’s own network rather than answered publicly.
A resolver that checks every query against threat intelligence and blocks the ones leading somewhere harmful.
R
The resolver that does the work for a client, following referrals until it has an answer to return.
Resolution in the other direction: finding which name belongs to a given IP address.
Response Policy Zones: a mechanism for overriding DNS answers according to local policy.
S
Secure access service edge: network and security controls delivered together from the cloud edge.
Software-defined WAN: routing branch traffic over whichever link suits the application at the time.
Software-defined networking: separating the control plane from the hardware that forwards the packets.
T
- Top-Level Domain (TLD) The last label in a domain name, such as .com or .fr, delegated from the DNS root. DDI
Z
A model that verifies every request instead of trusting anything because it is already inside the network.
Zero Trust Network Access (ZTNA)
Access granted per application after identity and posture checks, rather than by putting a user on the network.
More from EfficientIP
Blog
Current thinking on DNS architecture, security and automation.
Case studies
How other network teams run DDI at scale.
Resources
White papers, datasheets and analyst reports, filtered by topic and format.