DNS · appears in CAIQ, SIG
Are the standard apex DNS records (A/AAAA/NS) published and resolving correctly?
Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- Apex DNS records resolve correctly across the queried record types
- Partial
- Apex DNS records resolve but with warnings
- No
- Apex DNS records are missing or fail to resolve
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.6 | Authoritative DNS records demonstrate domain ownership and DNS hygiene. |
| ISO 27001 | A.8.20 | — |
| NIST 800-53 | SC-20 | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
Apex A/AAAA/NS records removed or no longer resolve.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.