mipo

Resolver Groups

Resolver groups are DNS vantage points: sets of resolver workers that share the same network reach and DNS visibility. Reverse-DNS work for a scan execution is bound to ONE resolver group and may move only between its members. A resolver belongs to exactly one group, chosen when the resolver is created and changeable from the Resolvers list; this page manages the groups themselves. The DNS queue runs today: an execution that requests reverse DNS gets a lookup task for each discovered host, bundled into jobs for its resolver group, but nothing claims those jobs until the resolver runtime ships.

Inputs

NameDescriptionAllowed valuesDefault
Name Unique label for this vantage point Non-empty string, must be unique across resolver groups
Description Optional note — where these resolvers sit and what they can see Any text, max 10,000 characters Empty

Fields & columns

NameDescription
NameEditable inline — the group label
DescriptionEditable inline — optional note
MembersHow many resolver identities are assigned to this group
OnlineHow many of those members are currently active (heartbeating)
In useWhether a resolver, a scan template or the global default references this group

How to

Stand up a vantage point for a segmented network

  1. Create a resolver group named for the network segment (for example "dmz-vantage").
  2. Create a resolver under Config › Resolvers and assign it to this group; install it on a host inside that segment.
  3. Point scan templates that scan the segment at this resolver group (any active reverse-DNS mode).

Gotchas

  • The DNS queue already runs (R1a). Still to come are the claim surface resolvers take jobs through (R1b) and the resolver runtime (R2); the groups and memberships configured today are what they will use.
  • Members MUST see the same DNS: work moves freely between them, so evidence from one member is treated as equivalent to another.
  • Do not mix resolvers from different networks in one group; create one group per vantage point instead.
  • A group with members, or referenced by a template or the global default, cannot be deleted.
  • If no member is online, DNS work for that group waits until the execution deadline (15 minutes after the scan ends), then expires, and the execution closes its reverse DNS incomplete (reason no_resolver) — the port scan itself is never delayed.

API calls (7)

MethodPathDescription
GET /api/config/resolver-groups List all resolver groups with member and online counts
POST /api/config/resolver-groups Create a resolver group
GET /api/config/resolver-groups/:id Get one resolver group
GET /api/config/resolver-groups/:id/members List the resolver identities in a group
PUT /api/config/resolver-groups/:id Update a resolver group
DELETE /api/config/resolver-groups/:id Delete a resolver group (if unreferenced)
GET /api/config/resolver-groups/filter-values Get available filter values for the table

Related

  • Settings — The global reverse-DNS default names the vantage point that performs inherited lookups
  • Resolvers — The worker identities that belong to a group
  • Nameserver Groups — The servers a group's resolvers may be told to query
  • Scan Templates — Where a template picks the resolver group that performs its lookups