Live records versus historical observations
A live DNS query reports what a resolver answers at collection time. Passive DNS datasets aggregate observations from participating sensors. They can help identify past associations between domains and addresses, but coverage is limited by sensor location, collection policy and retention.
First-seen and last-seen dates are dates of observations within a dataset, not necessarily the beginning or end of a DNS configuration. A gap in observations does not prove a domain was inactive.
Comparing changes responsibly
Nameserver migration, changed MX records and IP movement can reflect routine maintenance, platform changes or incident activity. Compare the timing with messages, compromise reports and other case evidence. Treat shared infrastructure as a lead, not common ownership.
For monitoring, preserve successive raw snapshots and compare equivalent queries. TTL differences alone can arise from cache aging. The current public tool supplies one snapshot, not an historical feed or continuous monitoring service.
Timeline essentials
Keep observation times separate from event times asserted by a source. Document the provider, dataset limits and how the comparison was made.
- Identify live, passive and authoritative data sources.
- Compare the same record types and names.
- Label dataset first/last seen dates correctly.
- Preserve alternative explanations for infrastructure changes.