DNS Status
DNS resolution status across four layers: public FQDN resolution via DNS-over-HTTPS, host system resolver configuration, Docker container hostname resolution, and reverse DNS / ASN data for registered scanners. Forward-confirmed reverse DNS (FCrDNS) is checked where applicable.
Fields & columns
| Name | Description |
|---|---|
Hostname (Public) | The configured public FQDN resolved via Google/Cloudflare DoH |
A Records | IPv4 address records with TTL for the public hostname |
AAAA Records | IPv6 address records with TTL for the public hostname |
Reverse DNS (PTR) | PTR record for the resolved IP — used for FCrDNS validation |
PTR Match | Whether the PTR record matches the forward hostname (FCrDNS check) |
Nameservers | DNS nameservers configured in the host system resolver (/etc/resolv.conf) |
Search Domains | DNS search domains from the host resolver configuration |
Resolved IPs (Internal) | IP addresses the FQDN resolves to from the host perspective |
Total Services / Resolved (Container) | How many Docker service hostnames resolve via the embedded DNS (127.0.0.11) |
Container DNS table | Per-service forward IP, reverse hostname, and resolution status |
Scanner DNS table | Per-scanner external IP, hostname, PTR record, and ASN information |
With PTR Match | Count of scanners whose PTR record matches their reported hostname |
Gotchas
- Scanner DNS data is informational for GRC audits — it does not affect the overall DNS health status.
- PTR mismatches (forward and reverse DNS disagree) can cause some services to reject connections, but are not critical for scanning.
- Container DNS failures indicate Docker networking issues that will break inter-service communication.
- Public DNS uses DoH (DNS-over-HTTPS) so results reflect what external clients see, not local resolver behavior. A deployment reachable only on a LAN through internal (split-horizon) DNS has no public record by design: the Public card is then Unhealthy while the Host System Resolver card shows the name resolving for clients on that internal DNS. The alert says which of three things happened: a public resolver answered that there is no A or AAAA record, the check could not be completed (no resolver reachable, or a resolver error such as SERVFAIL — which shows nothing about the records), or the configured public URL is not valid. A hostname with only an AAAA (IPv6) record counts as resolving. Resolving a name does not show that the service is reachable.
API calls (1)
| Method | Path | Description |
|---|---|---|
| GET | /api/health/infra/dns | Fetch public, internal, container, and scanner DNS health data |