Live DNS Zone Reads Expose Gaps in Customer Evidence Ledgers
A healthtech platform cannot treat a successful domain check as permanent evidence. Application logs preserve the product's decisions; live DNS zone reads capture a later observation. Customers keep control of their zones, while the platform still has to explain what it accepted, when it checked, and what the domain publishes now. Those are different questions, and DNS auditing needs both…
In the healthcare technology sector, it is crucial to distinguish between application logs and live DNS zone reads when establishing evidence of actions taken. Application logs preserve the decisions made by the system, while live DNS zone reads capture the current state of the domain. Both types of records are essential and should be kept separate to maintain a comprehensive audit trail.
Customer control over their DNS zones is a key factor in designing the system, as the platform does not have control over every change made to the domain zone. Similarly, platform-owned zones may have a change trail from the system that writes records, but these should still be treated as separate evidence sources.
The reconciliation process should not overwrite either source but rather join the evidence together. This means that an application event can prove that a change was requested or accepted, while a live DNS read can show the state visible during a particular observation. Neither source alone is sufficient to complete the other, and any mismatches should be investigated rather than quietly repaired.
To create an effective evidence model, start with three records: an application event, a DNS observation, and a reconciliation result. Keep the raw answer alongside the normalized comparison value, as this allows both code comparison and auditor inspection. The reconciliation function should compare a verification token recorded by the application with one observed in DNS, ensuring that both the domain and expected token are consistent.
The function should return an indeterminate result if there is a domain mismatch, observation failure, or the expected token is not found in the normalized answers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
