DNS Footprints in the Graph
Understand how DNS Explorer snapshots become dated entities and relationships, and what they do not claim.
A DNS footprint is the set of public DNS records for one domain at one time. Y2 collects it from DNSDumpster when a Pro or Elite workspace looks up the domain. Each answer becomes a snapshot with the time that it arrived.
Why snapshots are dated and shared
DNS records change. A host can move to another address or another network. A dated snapshot keeps what the provider returned at that time. A later snapshot does not replace an earlier one. Y2 keeps both and marks a snapshot whose records changed.
Public DNS gives the same answer to every requester. For this reason, Y2 gives the same snapshot to every workspace for 14 days. During that time, a lookup opens the saved snapshot and does not use an allowance. After 14 days, the next lookup takes a new snapshot. This reuse also keeps requests within the provider's free tier.
How records become entities
| Record | Entity |
|---|---|
| The domain and each host name | indicator with an exact domain identifier |
| Each address | indicator with an exact IP identifier |
| Each netblock | indicator with an exact prefix identifier |
| Each network operator (ASN) | organization with an exact ASN identifier |
| Each address location | country with its ISO code |
Exact identifiers prevent the merge of unrelated hosts, addresses, or netblocks.
A network operator name, such as CLOUDFLARENET - Cloudflare, Inc., goes through governed entity resolution.
Resolution can attach the operator to a company that Y2 already tracks.
How records become relationships
| Record | Relationship |
|---|---|
| Host under the domain | host part_of domain |
| Mail server, name server, or host outside the domain | domain references host |
| A record or CNAME | host references address or target |
| Address in a netblock | address part_of netblock |
| Address announced by a network | operator operates address |
| Address located in a country | address located_in country |
| Organization whose official website is the domain | organization operates domain |
Each relationship cites the snapshot's observation as evidence. Its first and last evidence times extend when a later snapshot shows it again. Thus the graph keeps when a host first and last resolved to an address.
The operates link to a known organization needs the official website that Y2 already records for it.
A lookup by entity uses that website. It cannot assign a new domain to an entity.
What a footprint does not claim
referencesmeans that a record points to a host or address. It does not claim ownership or control.- Domains on a shared address, such as a CDN address, connect through that address. This does not show a relationship between their owners.
- The free tier returns up to 50 A records. A capped snapshot has
truncatedset totrue. - A host that is not in a capped snapshot can still exist.
- A snapshot shows the records at capture time. It does not show the current records.
- The country is the provider's location for the address. It is not the location of the domain owner.
Privacy
Snapshot history shows that a domain was looked up and when. It does not show the workspace or person that requested the lookup. Each workspace keeps its own list of lookups. Account deletion removes a person's lookups. Shared snapshots remain.