Tools · Attack surface inventory · 23 / 23
Gobuster: a resolved name is not the zone text
In a DNS run, a found name with an address is a resolution from that run. It is not a line copied from the zone file. Write the name and the address. Do not describe the zone’s record type unless you opened the zone.
The line is an answer you observed
A DNS-mode line that reports a name and an address means the resolver returned that address for that name while the job ran. That is an observation. It does not show whether the zone stores an address record, an alias, or something else.
The address is the answer you got. It is not the text of the zone, and it is not a statement about every other name.
The zone file is a different artifact
The zone text, if you are allowed to read it, is the operator’s records. It can name types and targets the DNS line did not print. Until you open it, write “zone text not opened.” Do not invent a record type to match the address.
A later change to the zone does not rewrite this line. The line stays the answer from this run.
What to file
File the name, the address, the resolver or target the job used if you have it, and the time. If you also quote the zone, label that quote as the zone text and say who showed it to you. Do not merge the two into one unlabeled record.
Worked case: an address called a static zone line
A lab DNS run prints old-app.lab.example with address 203.0.113.40. A draft says the zone file contains a static address record for that name, because an address came back. Nobody opened the zone.
The note quotes the name and 203.0.113.40 as the resolution from this run. Zone text: not opened. The record type is not stated. The draft’s static line is removed.
name: old-app.lab.example address observed: 203.0.113.40 zone text: not opened record type: not in this line write: a resolution from this run not: a static line from the zone file
Diagram
An observed answer and the zone file
The run saw an address. It did not read the zone.
Shows. The name and the address that came back
Means. A resolution at that time
Does not. Name the record type
Shows. The records an operator stored, if you open them
Record type. Only if that text says it
Not opened. Say so, and do not invent the line
Check yourself
1. A DNS line shows old-app.lab.example and 203.0.113.40. What is that?
2. You have not opened the zone. What record type do you write?
3. The zone is edited the next day. What happens to this line?