# Differing DNS answers: event-domain observation sheet

This is a read-only diagnosis record. Use the *same fully qualified hostname and record type* for each observation. Do not change the zone, flush someone else's resolver cache, or declare a global outage from one screenshot.

## 1. Attendee symptom and exact question

| Field | Observation |
|---|---|
| Event and affected user journey | [ ] |
| Exact hostname, including apex or `www` / registration subdomain | [ ] |
| Record type (A, AAAA, CNAME, MX, etc.) | [ ] |
| First affected time and local time zone | [ ] |
| Client network, VPN, private DNS or encrypted DNS in use | [ ] |
| What still works and what fails | [ ] |

## 2. Authority and resolver comparison

| Query source | Timestamp/time zone | Response status | Answer or target | TTL / SOA serial if available | Notes |
|---|---|---|---|---|---|
| Delegated authoritative server 1: [name] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Delegated authoritative server 2: [name] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Affected network's recursive resolver: [address/name] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Comparison recursive resolver: [address/name] | [ ] | [ ] | [ ] | [ ] | [ ] |

Record the parent delegation or registrar's current nameserver set separately: [ ]. Record the last approved zone or provider change and its time: [ ]. Do not assume an IP difference is wrong if the DNS service intentionally uses geography or traffic routing.

## 3. Interpretation and owner

| Pattern seen | Question to ask | Owner to contact |
|---|---|---|
| Authoritative servers disagree | Was the zone published consistently? | Authoritative DNS operator |
| Authority agrees; recursive answers differ | Cache age, stale serving, policy or private view? | Resolver/network operator |
| One resolver returns SERVFAIL | Is validation, delegation or authority reachability failing? | DNS operator with resolver evidence |
| DNS agrees; browser still fails | Is HTTPS, CDN, application or external checkout the actual issue? | Web/application or ticketing owner |

Diagnosis: [ ]. Evidence supporting it: [ ]. What this evidence **does not prove**: [ ]. Next read-only observation or authorized change: [ ]. Owner: [ ].

## 4. Verification after an authorized fix

| Check | Result and time |
|---|---|
| Each delegated authority answers as intended | [ ] |
| Named resolvers from affected networks converge or have an explained difference | [ ] |
| Event page works over HTTPS | [ ] |
| Registration or external checkout route works (checked separately) | [ ] |
| Incident update sent to affected attendees/staff if needed | [ ] |

No universal propagation timer proves completion. Keep the observation history with the change record.