HomeDNS Authentication Playbook — 2026

Technical source document

DNS Authentication Playbook — 2026

Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.

Original GitHub document All documentation

DNS Authentication Playbook — 2026

Purpose

This playbook documents validated steps for diagnosing and resolving DNS-related authentication issues that affect domain-joined clients and Entra ID synchronization points.

  • Pre-checks

  • Confirm authoritative DNS server reachability (timeout < 250ms) from affected host.

  • Verify time sync on domain controllers and clients (NTP).

Steps

  1. Verify basic DNS resolution from the client: nslookup <fqdn> and ping -n 1 <fqdn>.
  2. Confirm SRV records for LDAP/GC and Kerberos exist: _ldap._tcp.dc._msdcs.<domain>.
  3. Check DNS scavenging or replication issues on DNS servers; review event logs for DNS-related errors.
  4. For split-brain DNS, confirm the internal zone contains correct A and CNAME records for domain controllers and services.
  5. Validate conditional access and identity provider endpoints reachable from client network segments.

Validation

  • After remediation, re-run authentication flows and capture nltest /sc_verify:<domain> and klist outputs.

  • Record timestamped validation notes and attach DNS query traces to the incident log.

  • References

  • RFC 1035 — DNS Basics

  • Internal lab notes: network validation checklist and pfSense segmentation documentation.