- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
What is DNS flag day?
12/20/2019 
5 People found this article helpful
95,151 Views
Description
"DNS Flag Day is an initiative by the DNS Community to deprecate and remove support for an older DNS workaround that DNS vendors have been using for years. The goal is to make DNS software a little less complex, easier to maintain, have more predictable behavior, and improve performance.
In this case, the changes are related to how DNS query timeouts occur. In the past, DNS resolvers, when encountering a timeout from an authoritative, would retry the DNS query without EDNS being enabled. Starting on February 1, 2019, EDNS will not be disabled by major public DNS resolvers and vendors when DNS query timeout occurs. This means if your Authoritative DNS servers do not respond properly to DNS queries that utilize EDNS, the DNS query will effectively timeout."
The SonicWall Solution for SMA1000 regarding DNS Flag Day
A DNS request handling routine in the GTO SMA firmware can fail during processing of a very specifically formatted DNS request type resulting in the affected node being unable to process GTO name resolution requests. This issue is relevant only to appliances participating in a Global High Availability cluster - all other appliance deployment models are unaffected. The code in question has been carefully analyzed and a targeted fix that eliminates the problem from occurring has been developed and delivered via this hotfix release.
When a GTO service name served by an unpatched GTO SMA is tested with the DNS Flag Day test tool, the problem described above may be observed. Further, it should be noted that the results from the DNS Flag Day test tool on a properly patched GTO SMA will report an error that indicates that the “EDNS – over TCP Response” test has timed out. This is an expected result as these GTO SMAs do not currently support or require DNS via TCP – which has no impact on their operations but does cause the test itself to fail. This will NOT result in such GTO SMAs being unavailable after Feb 1. However, SonicWall is currently developing updates that will eliminate these test failures and set the system up for proper operation with all future DNS operations.
Learn more about DNS Flag Day.
Related Articles
- Configuring Device Management based on Device ID for SMA 100
- CT with Device Guard is stuck on Identifying when GVC Client is installed
- SMA1000: CT compatibility with 3rd party VPN clients like GVC, Citrix and Fortinet
YES
NO