jperezduerto.info
Security in depth · Unit 18 · Lesson 4 of 8
DNS answers are time-bound evidence
Interpret resolver timing and caching without turning a DNS answer into an ownership claim.
Helpful before thisReconnaissance: building an evidence-based map
After this lesson you can
- Explain why two supplied DNS observations can differ without proving compromise or ownership.
One idea. One situation. One reasoned decision.
How it works
DNS maps names to records under a distributed system with caching and time-to-live values. An answer reflects a resolver’s view at a time; it is not a permanent ownership certificate. Records may point to shared infrastructure or providers. In an inventory, retain the record type, observation time, and relevant context, and avoid assuming that every system at a returned address belongs to the same organization.
Read the supplied record
A fictional record packet describes one name and two resolvers. The owner records an authoritative address change at 09:01 UTC.
| Observation | Resolver view |
|---|---|
| 09:00, R1 | Address A, cached with a 300-second TTL |
| 09:02, R2 | Address B after obtaining the changed record |
| Provider note | B belongs to shared hosting infrastructure |
Under the ordinary caching assumptions in this example, R1 may reuse its earlier answer until its cache timer expires. The 300 seconds do not freeze the authoritative record or guarantee that every client sees A for exactly that duration. Other resolver behavior is not established by this packet.
Record both observations with resolver, time, record type, and cache context. They are compatible with the documented change. Neither proves that A remains an operated application, that B grants application access, or that all shared-provider services belong to this owner. Resolve those separate questions through the appropriate service and ownership records.
The key distinction: A DNS relationship and asset ownership are different claims.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What is a defensible explanation of the supplied difference?
Show the answer
Correct answer: The records are compatible with a change and separate resolver caches; they do not alone establish current ownership or compromise. R1’s cached view and R2’s later view can differ within the stated timing without contradicting either observation.
Try it
- WriteWrite two dated inventory observations, keeping resolver, record type, answer, and cache context separate. Add one ownership question the DNS records cannot answer.