~/tutorials/018-the-zone-as-an-asset-list.md

018: The zone, as an asset list

Lesson eight read the zone a record at a time. Field work reads it as a whole: every record is something the domain commits to, and an asset list is what you defend. Read it like the owner, because one day the zone is yours.

The full answer

dig l1ackers.com

Seven rows at the time of writing. Two A records for two names, four MX for mail, two TXT for policy, and each row is a commitment: this name resolves here, mail goes there, these senders are ours.

What each record commits you to

An A record commits an address. dig www.l1ackers.com | grep A shows the same address as the apex, which means www is not a separate machine, and the commitment is one box wearing two names.

dig l1ackers.com | grep MX | wc -l

Four MX records, and count them with the pipe because a zone read by eye is a zone half-read. In prose, so you can compare: l1ackers.com. 7200 IN MX 10 mx001.netsol.xion.oxcs.net. and its sibling mx002, two of four, all priority 10, none of them yours. Every one of those names is infrastructure this domain depends on to receive mail, which makes each one a place the mail can be watched, filtered, or lost. A zone answers who you trust, and this one trusts four strangers equally.

The TXT records commit policy. One says which senders may speak as this domain, one proves control to a vendor, and the CNAME under _domainkey hands DKIM signing visibility to another party. Nothing here is technical trivia: each record is a sentence in the contract the domain has signed with the world.

The record that does not exist

dig mail.l1ackers.com

Not in the zone, and the refusal is also information. No mail subdomain exists because mail is outsourced whole, and the asset list of a modern domain is mostly other people's infrastructure wearing your name. The gap tells you where the actual perimeter sits: not at your machines, at your vendors.

Try it

Each of these has one answer, and the shell gives it to you. Check yourself.

1. How many records total? One dig, one wc, and say what fraction is somebody else's infrastructure.
2. Which single IP answers for both the apex and www? What does that pair tell you about how many machines are really behind this site?
3. Read the four MX names and say what they have in common. Then say what that common part implies about who runs them.
4. Ask for a name that is not in the zone and read what comes back. Where does the boundary of this domain actually sit?

Numbers and names age with the zone. The snapshot is stamped on every answer, and the command is the current list.