Asset change review checklist for small teams
Turn asset and DNS snapshot differences into a repeatable review with source provenance, owner confirmation and documented decisions.
Articles
Technical reconnaissance guides
Practical methods, reproducible examples and source-backed explanations to help interpret your asset evidence. Start with the worked snapshot comparison or use the free workspace.
Technical asset inventory: what counts as evidence?
Distinguish DNS records, passive hostname sightings, verified services and asset ownership when building a technical inventory.
Collect DNS evidence on Linux, macOS and Windows
Use dig on Linux or macOS and Resolve-DnsName on Windows to collect scoped public DNS answers and produce a Recon.ph-compatible CSV.
How to review a DNS zone export before import
Prepare a BIND-style DNS export for asset comparison: understand origin, relative names, record values and import limitations.
Export DNS evidence from Azure DNS and Amazon Route 53
Export an Azure DNS zone file or Route 53 record-set JSON, understand format differences, and prepare a supported Recon.ph CSV input.
How to export a Cloudflare DNS zone for asset review
Export DNS records from Cloudflare's dashboard or authorized API, preserve the original zone file, and compare two snapshots in Recon.ph.
How to export a GoDaddy DNS zone file
Download a GoDaddy-managed DNS zone, identify its BIND records, and compare a baseline with a later export without changing DNS.
A CNAME target changed: how should you investigate?
Interpret a CNAME target change using comparable evidence, change records and service ownership instead of assuming compromise.
Passive subdomain discovery vs DNS: what does each prove?
Why a passive hostname sighting, configured DNS record and live DNS answer should be treated as separate evidence.
Worked example: compare two DNS snapshots
Reproduce a before-and-after DNS comparison, interpret two host changes and four record changes, and avoid false security conclusions.