Aduana Digital de Defensa Argentina
Create ADDA access
← ADDA Manual

dns-policy/1.1.0 · updated Jul 9, 2026

Defensive DNS

How to review domains, email, and resolution decisions with clear criteria.

ADDA DNS prioritizes resolution signals, domain consistency, links to email, and patterns that deserve monitoring before trust is established.

A mature DNS operation goes beyond checking whether a domain resolves. It also assesses name sensitivity, expected jurisdiction, heuristic age, email consistency, and whether the situation calls for a score, watchlist, or incident.

Use this guide to decide when to observe, verify, or leave a stronger institutional marker, especially when the domain resembles critical infrastructure or public identities.

Checklist

  • • Validate the organization's active policies.
  • • Run a DNS check on high-exposure domains.
  • • Record the decision when the domain needs special monitoring.

Quickstart

  1. 1. Choose a priority domain and run an institutional check.
  2. 2. Compare severity, action, and reason codes before blocking or marking it.
  3. 3. If the domain affects email, cross-check it with the mail article and evidence.

Operational flow

Register domain

Add the domain to the inventory or to the case that prompted the review.

Avoid isolated analysis without an operational reference.

Assess risk

Read the DNS result with institutional sensitivity and email coverage in mind.

Decide whether to observe, verify, or escalate.

Connect the response

If the risk persists, link a watchlist, early warning, or incident.

Do not leave the reading detached from the main workflow.

flowchart LR
  S1["Register domain"]
  S2["Assess risk"]
  S3["Connect the response"]
  S1 --> S2
  S2 --> S3

Validators and checks

They run a contextual reading for this surface and return suggested steps with an operational focus.

Check a critical domain

Returns DNS coverage, related articles, and next steps.

Examples

DNS check payload

{
  "domain": "secure-capacero.ar",
  "mode": "institutional"
}

Links and references

APIs

  • /api/adda/v1/dns/check
  • /api/adda/v1/dns/policies
  • /api/adda/v1/domains

Docs and supporting routes

  • docs/ADDA_DNS.md
  • docs/ADDA_API.md

Common issues

  • • Making decisions from a suspicious name without cross-checking context can overstate the risk.
  • • Separating DNS from mail or incidents often hides impersonation patterns.

Suggested actions

  • • Escalate to a watchlist when the domain reappears or combines with campaigns.
  • • Use evidence if the domain prompted an action visible to third parties.

Useful reason codes

DNS_SUSPICIOUS

The domain shows traits commonly seen in campaigns or impersonation.

Strengthen the review and limit initial trust.

FOREIGN_ASN

The territorial reference does not match the expected mode.

Confirm the context before assuming legitimacy.

DNS_NO_MX

The associated email lacks the expected consistency.

Cross-check with the mail check before closing the assessment.

Score dictionary

severity

Institutional priority of the signal on the ADDA scale.

action

Next operational step recommended by the engine.

reasonCodes

Explainable reasons that justify the reading.

Protocol notes

  • • For sensitive domains, use institutional or critical_infrastructure mode.
  • • DNS does not replace intelligence: it complements and triggers it when needed.

Article history

Jul 9, 2026

Added quickstarts, a payload example, and escalation guidance for incidents and intel.