A DNS rollback may restore an earlier infrastructure state while deleting a selector or policy introduced afterward. Restore the intended current mail configuration, not whichever backup is easiest to import. First establish which authority serves the affected names and what changed during the rollback.
Freeze the evidence before repairing
References: RFC 6376 §3.5.
Capture the rollback time, previous export, current record set and authorized changes since the backup. Compare exact names, types and values for SPF, DMARC, selectors, return paths and receiving routes. A missing record and an old but present record are different failures. Preserve messages showing the affected selector and signing domain; a vendor dashboard alone may not reveal which selector is still active.
Do not reintroduce every removed record. A historic SPF entry may authorize a retired service, and an obsolete alias can restore an unwanted dependency. Ask the service owner which senders and keys remain intended. Treat restoration as an approved, current-state diff with named exceptions, not an unrestricted full-zone overwrite.
Repair the smallest correct set
References: RFC 7208 §4.5, RFC 4035 §5.
Read the live zone again immediately before applying the diff so that another team's intervening change is not lost. Preserve the current recovery export and record each addition, replacement or deletion. Ensure an SPF repair leaves one selected SPF policy at the owner rather than adding a second policy alongside the broken one.
Check the DNSSEC chain if rollback changed keys or authority. Restoring signed records with expired signatures or a child key incompatible with the parent DS does not restore valid resolution. Provider-managed signing should be repaired through its supported workflow, with validation evidence kept separately from ordinary DNS visibility.
Work through a three-snapshot fixture
In an offline fixture, backup A contains selector s1 and SPF v=spf1 ip4:192.0.2.10 -all. Approved state B retires that sender, changes SPF to v=spf1 ip4:192.0.2.20 -all and adds selector s2. Accidental rollback C equals A. The correct restoration diff replaces the SPF policy and restores s2; whether s1 remains requires the documented key-retirement decision.
Represent A, B and C as JSON objects keyed by owner and type. Compare sorted record values while preserving separate TXT records. Expected output includes a changed apex TXT set and the missing s2 owner. The documentation addresses are synthetic. Never apply this example policy to a production domain.
For an isolated DNS version, publish C and then the approved repair, querying each authority with dig @AUTH example.test TXT +norecurse and dig @AUTH s2._domainkey.example.test TXT +norecurse. Use marker data for selectors and label it non-cryptographic. Retain both answers and the exact repair diff. Live recovery and signed-message validation are pending.
Account for stale success and stale failure
References: RFC 2308 §5.
A resolver may keep the pre-rollback good answer and hide the fault temporarily. Another may cache a missing-selector response and continue to fail after repair. Record query time, resolver, response code and TTL context; do not keep editing correct authority data to force a cached view to change.
After authoritative repair, observe recursive paths and send approved harmless test messages through each affected service. Compare authentication results with original headers and known receiver behavior. Close the incident with the corrected inventory, cause of rollback and backup safeguards. Restored DNS is a prerequisite, not proof of delivery or an excuse to remove enforcement broadly.
Executed isolated lab evidence
The retained 7 November 2026 isolated socket lab served the backup state, then applied the locally predefined synthetic repair. Actual UDP queries observed the old SPF address and missing s2 before repair, and the new SPF address and s2 marker afterward. The rollback plan retains backup restore material, the current intended state, two exact changes and dependency ownership. No production record was changed. The capture labels are rollback_before_spf; rollback_before_s2; rollback_after_spf; rollback_after_s2. The reproducible runner and raw captures are included in the evidence package. Production DNS, DNSSEC and SMTP outcomes remain untested.
For this 8 November 2026 review, the retained wire captures and repair diff were checked offline. No DNS server, dig command, DNSSEC validation or SMTP test was rerun.