DNS Resolver Cache
Definition
A temporary store of DNS query results held by the operating system. Entries reveal which domain names a host has recently resolved, potentially exposing command-and-control (C2) infrastructure, data exfiltration destinations, or phishing sites visited before the incident was detected.
- Held by
- Operating system
- Contents
- Recently resolved domain names
- Volatility
- Temporary, cleared over time or on reboot
- Investigative value
- C2, exfiltration, and phishing domain traces
Common questions
Why must the DNS resolver cache be captured early in live response?+
Cached entries expire according to each record's time-to-live and are lost on reboot, so an incident responder who delays live capture risks losing evidence of domains the host contacted shortly before the incident.
How does a resolver cache differ from a network-level DNS query log?+
The resolver cache is local to one host and shows only what that machine currently has cached, while a network DNS query log captured at a shared resolver can cover many hosts over a longer retained period, so the two sources complement rather than duplicate each other.
Related terms
- ARP Cache
- A table held in memory that maps IP addresses to hardware (MAC) addresses for recently contacted hosts on the local network. ARP...
- Live Response
- The process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Process Tree
- A structured representation of running processes showing each process alongside its parent. Malware frequently spawns command shells or other processes from unexpected...
- Trusted Response Kit
- A portable collection of statically compiled, cryptographically verified forensic tools stored on write-protected media. Used during live response to avoid executing potentially...