How a laptop actually finds a nameserver (stub vs recursive, DHCP option 6, when not to point clients at this binary): dns-how. How to create a keytab, TSIG key, or PowerDNS API key and why: integrations.

Lattice is DDI: IPAM and DHCP are always on. DNS is two things:

Adapters — worker writes A/PTR into AD (GSS-TSIG) or BIND/PowerDNS. Workstations keep querying those servers. Use this for the AD forest.
lattice-dns — authoritative nameserver for internal Lattice-managed zones only. Recursion is off. It is not a workstation cache, not public DNS, and not the place to host ad.example.com or _msdcs.

Deploy modes (per zone)

Mode	NS records	What the laptop asks (option 6)	Subnet `ddns_adapter`
Adapter-only	AD or existing BIND	Unchanged (DCs / BIND)	`ad_gsstsig` / `bind_tsig` / `powerdns_http`
Hidden primary	BIND/Knot secondaries	Those servers, not Lattice	`embedded`; secondaries AXFR from lattice-dns
Published Lattice	lattice-dns VIP	lattice-dns only if that zone is all they query	`embedded`

NS records are for other nameservers. Stubs use DHCP option 6. Lattice does not set option 6 when you enable embedded. Do not put the lattice-dns VIP in option 6 on a site that still needs AD or the internet unless Unbound (or BIND as a cache) sits in front and forwards only our zones.

Do not point the same zone at embedded and an external adapter. Split brain.

What it answers today

SOA/NS from dns_zone
A/AAAA/PTR from leased rows and static_record
Off-zone query → REFUSED
Name in zone, no such RR type → NODATA (NOERROR)
Name not in zone → NXDOMAIN
RecursionAvailable=0

SOA serial increases when static records change and when the embedded adapter sees grant/renew/release/expire.

AXFR is TCP-only. allow_transfer is a list of IPs/CIDRs (empty = deny, fail-closed). Optional transfer_tsig_name + transfer_tsig_secret_ref (env:NAME / file:/absolute/path). After a serial bump, lattice-dns sends NOTIFY to also_notify.

Production :53 with CAP_NET_BIND_SERVICE, 2+ identical processes, UDP VIP like dhcpd.

Hidden primary (BIND secondary)

Current BIND 9 ARM uses type secondary and primaries (zone types). Older configs used type slave and masters; both still work on many releases. Confirm against the ARM for your BIND version.

zone "office.example.com" {
    type secondary;
    file "slaves/office.example.com";
    primaries { 10.0.0.10 port 53; };  // lattice-dns VIP
};

On the Lattice zone: allow_transfer = the BIND IPs, also_notify = those IPs. NS records at the parent should be the BIND servers, not Lattice, if you want Lattice hidden.

Not in this binary

Recursive lookup, forwarding, RPZ, public/external DNS, DNSSEC. lattice-dns is for internal zones. Internal clients almost never validate DNSSEC on private names, there is no registrar DS to hang a trust chain on, and a bad signature would SERVFAIL your own intranet. Leave it unsigned.

If you need a cache for workstations, run Unbound/BIND in front and conditional-forward our zones here; leave AD on the DCs.

IXFR: if the secondary’s serial is the previous compiled snapshot, lattice-dns sends an RFC 1995 delta. Older serials get a full AXFR. Process restart forgets history, so the next IXFR is AXFR.