DNS Job Receipt

The full signed execution-proof receipt for a single DNS job (one resolver's unit of reverse-DNS work). It shows the three canonical hashes (context, task spec, and observations), the lookup coverage (attempted versus planned, plus how many resolved, returned no PTR record, or failed), the final status, the resolver binary and protocol versions, the start and completion timestamps, the mandatory resolver signature, and the verbatim receiptJson the resolver submitted. Every receipt shown here was verified by ingest against the resolver's mTLS leaf before it was stored, so a receipt you can read is one the server has already verified. Use this view as the forensic anchor when reconciling the hostnames a scan's results show against the DNS evidence that produced them.

Fields & columns

Name	Description
`DNS job / Scan / Resolver`	The DNS job this receipt proves, the scan it enriched, and the resolver identity that performed the lookups. The scan link returns to that scan's Execution Proof page.
`Status`	Final DNS job status the receipt was written for (completed, partial, failed, cancelled, timed_out) — a subset of the job statuses, written onto the job verbatim.
`Lookups (attempted / planned)`	Coverage: hosts the resolver attempted to resolve versus hosts the scheduler planned for this job. Equal on a completed receipt; attempted is lower on an incomplete one.
`Resolved / No PTR / Failed`	Breakdown of the attempted lookups by outcome: a PTR record was found, the query succeeded with no PTR record, or the lookup failed (timeout, nameserver error, resolver error).
`Resolver version / Protocol version`	The resolver binary version and wire-protocol version that produced the receipt, for fleet-version auditing.
`Started / Completed`	When the DNS job started and finished — the execution window the receipt attests to.
`Context hash`	SHA-256 over the normalized DNS context the job was expanded from (mode, nameserver/resolver group) — proof of WHAT DNS configuration produced this job.
`Task spec hash`	SHA-256 over the normalized, sorted set of lookup tasks assigned to the job — proof of WHICH hosts were queried.
`Observations hash`	Server-recomputed SHA-256 over the accepted observation batches this job reported. The evidence anchor for this DNS job's findings.
`Receipt JSON`	The verbatim forensic claim the resolver submitted. The raw record an auditor can re-hash independently.
`Resolver signature`	The resolver's ECDSA P-256 / SHA-256 signature over the canonical receipt message, verified by ingest against the mTLS leaf the resolver presented and stored with that leaf's SHA-256 fingerprint (R1b, D7). Mandatory — ingest refuses an unsigned submission, so this card always reads "verified at ingest".

How to

Reconcile a scan's hostnames against their DNS evidence

Open the scan's Execution Proof page and find the DNS receipts table.
Open the receipt for the DNS job that covers the host in question.
Confirm the job status is completed and the host falls within lookups attempted.
Read the observations hash and cross-check it against the raw evidence on the scan's DNS observations view.

Gotchas

Signatures are mandatory — every DNS receipt shown here was verified against the resolver's mTLS certificate when ingest accepted it. There is no "unsigned" state to review, unlike a scanner's execution-proof receipt.
Counts cover the observations the server STORED; a partial receipt means fewer hosts than planned were answered — it never means fewer than were stored were claimed.
This view reads from the jobs database. If it is temporarily unreachable, the page shows "DNS execution proof temporarily unavailable" instead of erroring. A receipt that genuinely does not exist (e.g. a DNS job that has not signed off yet, a receipt removed by retention after the 90-day evidence window, or a wrong id) shows a distinct "DNS receipt not found" state.
A receipt exists per DNS JOB, not per host. A scan enriched via a nameserver group with several resolvers can have several DNS jobs, each with its own receipt covering a slice of the host set.

API calls (1)

Method	Path	Description
GET	`/api/dns-jobs/:dnsJobId/receipt`	The single DNS job receipt detail, including the verbatim forensic receiptJson

Execution Proof — The scan-level list of scan and DNS job receipts; this detail view opens from a DNS receipts row
Job Receipt — The equivalent forensic detail view for a scanner's port-scan receipt on the same scan