Resolver Groups
Resolver groups are DNS vantage points: sets of resolver workers that share the same network reach and DNS visibility. Reverse-DNS work for a scan execution is bound to ONE resolver group and may move only between its members. A resolver belongs to exactly one group, chosen when the resolver is created and changeable from the Resolvers list; this page manages the groups themselves. The DNS queue runs today: an execution that requests reverse DNS gets a lookup task for each discovered host, bundled into jobs for its resolver group, but nothing claims those jobs until the resolver runtime ships.
Inputs
| Name | Description | Allowed values | Default |
|---|---|---|---|
Name | Unique label for this vantage point | Non-empty string, must be unique across resolver groups | — |
Description | Optional note — where these resolvers sit and what they can see | Any text, max 10,000 characters | Empty |
Fields & columns
| Name | Description |
|---|---|
Name | Editable inline — the group label |
Description | Editable inline — optional note |
Members | How many resolver identities are assigned to this group |
Online | How many of those members are currently active (heartbeating) |
In use | Whether a resolver, a scan template or the global default references this group |
How to
Stand up a vantage point for a segmented network
- Create a resolver group named for the network segment (for example "dmz-vantage").
- Create a resolver under Config › Resolvers and assign it to this group; install it on a host inside that segment.
- Point scan templates that scan the segment at this resolver group (any active reverse-DNS mode).
Gotchas
- The DNS queue already runs (R1a). Still to come are the claim surface resolvers take jobs through (R1b) and the resolver runtime (R2); the groups and memberships configured today are what they will use.
- Members MUST see the same DNS: work moves freely between them, so evidence from one member is treated as equivalent to another.
- Do not mix resolvers from different networks in one group; create one group per vantage point instead.
- A group with members, or referenced by a template or the global default, cannot be deleted.
- If no member is online, DNS work for that group waits until the execution deadline (15 minutes after the scan ends), then expires, and the execution closes its reverse DNS incomplete (reason no_resolver) — the port scan itself is never delayed.
API calls (7)
| Method | Path | Description |
|---|---|---|
| GET | /api/config/resolver-groups | List all resolver groups with member and online counts |
| POST | /api/config/resolver-groups | Create a resolver group |
| GET | /api/config/resolver-groups/:id | Get one resolver group |
| GET | /api/config/resolver-groups/:id/members | List the resolver identities in a group |
| PUT | /api/config/resolver-groups/:id | Update a resolver group |
| DELETE | /api/config/resolver-groups/:id | Delete a resolver group (if unreferenced) |
| GET | /api/config/resolver-groups/filter-values | Get available filter values for the table |
Related
- Settings — The global reverse-DNS default names the vantage point that performs inherited lookups
- Resolvers — The worker identities that belong to a group
- Nameserver Groups — The servers a group's resolvers may be told to query
- Scan Templates — Where a template picks the resolver group that performs its lookups