A Record
Definition
A DNS resource record that maps a domain name to an IPv4 address. The primary attribution record in most investigations. An AAAA record performs the same function for IPv6 addresses.
- Record type
- DNS resource record
- Maps to
- IPv4 address
- IPv6 equivalent
- AAAA record
- Use
- Domain-to-IP attribution
Common questions
Does resolving an A record identify the person behind a domain?+
Not by itself. The IPv4 address it returns may belong to shared hosting, a content delivery network, or a VPN or proxy service, so it points to infrastructure, not necessarily to a single individual or device.
What else do investigators cross-reference against an A record?+
WHOIS registration data, hosting provider logs, other DNS record types such as MX and NS, and historical DNS records are typically combined with the A record to build a fuller picture of who controls a domain.
Related terms
- DNS Tunnelling
- Encoding data inside DNS queries and responses to exfiltrate information or carry command-and-control traffic through a network that permits DNS but blocks...
- Domain Generation Algorithm (DGA)
- Code embedded in malware that produces a large set of pseudo-random domain names on a scheduled basis. The malware tries each until...
- Fast-Flux
- An evasion technique in which a domain's A records cycle through a large pool of IP addresses with very short TTL values....
- Passive DNS
- A historical database of DNS resolutions collected by sensors at recursive resolvers or network taps. Passive DNS shows which IP addresses a...
- WHOIS
- A query protocol that returns registration data for a domain, including registrant name, organisation, email, nameservers, and registration and expiry dates. Since...