Loading content
Resolution Chain
How a typed name becomes a connection to one specific machine — hop by hop, each a link of delegated trust and a place it can break.
What it is
Nothing on the web is reached by name; a name is only a promise to be resolved into an address. Between the label a human types and the server that answers sits a chain of delegated authority — registry, DNS, certificate authority — and each link is both a lookup and an attack surface.
Reading the resolution chain is the first move of any web investigation: it turns "example-bank.com" into an IP, an issuer, a set of records and a registration history — and each of those is a thread to pull.
Going deeper
The browser checks its own cache, then the OS cache, then asks a recursive resolver. If the resolver doesn’t know, it walks the hierarchy: a root server points it to the TLD (.com), the TLD to the domain’s authoritative nameservers, and those return the answer — which the resolver then caches for the record’s TTL. Most lookups never leave the cache; the full walk happens only on a miss.
Because every certificate a CA issues is written to public append-only logs, you can watch a domain’s logs to catch a certificate you didn’t request — the earliest sign of a mis-issuance or impersonation. Read the other way, CT is a global, real-time feed of new infrastructure appearing: every subdomain and staging host announces itself the moment it gets a certificate.
Privacy law redacted the registrant name and contact fields for many domains, but the structurally useful parts survive: creation and expiry dates, the registrar, and the nameservers. A brand-new domain, a bulk-registration registrar, or a nameserver shared with known-bad domains are all readable without a single contact field.
The rented label — registrant, registrar, registry, expiry.
A domain is a lease, not a possession: a registrant rents it from a registry through a registrar, for a fixed term. The registrar is the retailer; the registry runs the whole TLD. Lapses, transfers and expiry dates are all signals.
The distributed lookup: root → TLD → authoritative.
DNS walks a chain of delegation — root servers point to the TLD, the TLD to the domain’s authoritative nameservers, which return the answer — cached by recursive resolvers along the way. Whoever controls any link controls where the name points.
A/AAAA, MX, NS, TXT, CNAME — the name’s wiring.
A single domain carries many records: A/AAAA (addresses), MX (mail), NS (nameservers), CNAME (aliases), and TXT (SPF, DKIM, and verification tokens for third-party services). The record set is a map of everything the domain is wired to.
Who vouches that a key belongs to a name.
A certificate authority signs a claim binding a public key to a domain, forming a chain of trust up to a root the browser already trusts. The issuer, validity window and key details are all public in the certificate itself.
Public append-only logs of every certificate issued.
Every certificate a CA issues is logged to public, append-only Certificate Transparency logs — searchable by anyone. This turns TLS from a private lock into a global, real-time index of who is standing up which subdomains and when.
The registration record — WHOIS, and its structured successor RDAP.
WHOIS returns a domain’s registration record: registrant, dates, nameservers, contacts. RDAP is the modern structured replacement. Since GDPR much registrant data is redacted, but dates, nameservers and registrar remain highly useful.
Read it honestly
The resolution chain is fact, not opinion — machine-generated records with no agenda — which is exactly why it outranks self-description when they conflict. Its limit is that it shows the current wiring, not intent: a clean chain can still front a malicious operation, and a messy one a legitimate but under-resourced site.
Take Resolution Chain from reference to the live system.