client-1 · configuration assurance

25 Oct 2026 14:17 UTCdry run, nothing changed

Needs a person

ESCALATEName and its www treated differently by the proxy

DNS record host-524b42.quest (proxied) · zone host-4c795e.quest

since 16 Apr 2026 (191 days) · the hold ran out at 25 Oct 03:21 UTC

No record of who changed it: the audit log window of 18 h holds 0 events for the record.

What happened

  • 1 finding is with a technician: name and its www treated differently by the proxy at host-524b42.quest. No record of who changed it: the audit log window of 18 h holds 0 events for the record.

    finding · ticket #2 · DNS records
  • 23 findings are adopted under the technician's exceptions; 3 are held with an expiry.

    adopted · held

Held with an expiry

3 findings are held. At its expiry a held finding becomes an escalation unless a pass finds the setting at its approved value.

LabelWhereHeld untilReasonUnder
DNS record with no site behind itDNS record host-50b116.com (name) · zone host-525a57.com27 Oct 2026 23:21 UTC in 57 hnormal rule, holds up to 72 hrule-b8d9962485c3ced4
DNS record with no site behind itDNS record host-c10fff.com (name) · zone host-525a57.com27 Oct 2026 23:21 UTC in 57 hnormal rule, holds up to 72 hrule-b8d9962485c3ced4
DNS record with no site behind itDNS record host-3fef97.club (name) · zone host-1bf78f.club27 Oct 2026 23:21 UTC in 57 hnormal rule, holds up to 72 hrule-b8d9962485c3ced4

Adopted under the technician's exceptions

23 findings are adopted under the technician's exceptions, each until its exception's expiry: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.

The 23 findings by lesson, 15 lessons
LessonExpiresWhatFindings
mem-130 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangesites-available/host-f324df.com on host-4b4dc1 (2 settings)
mem-230 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangeconf.d/host-e49c58.cloud.conf on host-aa516a (2 settings)
mem-330 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangesites-available/host-4c795e.quest on host-4b4dc1 (2 settings)
mem-430 Nov 2026 00:00 UTCsite with no DNS recordsites-available/host-9ac4f1.com on host-4b4dc1
mem-530 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangeconf.d/host-e49c58.cloud.conf on host-aa516a (2 settings)
mem-630 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangesites-available/host-62f7a4.com on host-4b4dc1
mem-730 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangeconf.d/word-005ed8-prod.conf on host-aa516a (2 settings)
mem-830 Nov 2026 00:00 UTCsite with no DNS recordsites-available/host-085e02.com on host-4b4dc1
mem-930 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangeconf.d/host-503b27.ai.conf on host-aa516a (2 settings)
mem-1030 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangesites-available/host-525a57.com on host-4b4dc1
mem-1130 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangesites-available/host-525a57.com on host-4b4dc1
mem-1230 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangeconf.d/host-503b27.ai.conf on host-aa516a (2 settings)
mem-1630 Nov 2026 00:00 UTCsite with no DNS recordsites-available/host-9ac4f1.com on host-4b4dc1
mem-1730 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangesites-available/host-525a57.com on host-4b4dc1 (2 settings)
mem-1930 Nov 2026 00:00 UTCproxied name, origin trusts no Cloudflare rangenginx/nginx.conf on host-aa516a

Actions

No action is recorded for client-1.

Coverage

3 sources read: 1 provider, 2 hosts · 1,352 settings watched · 83 queries through sql.js over sample/bundle.json, 0 failed

SourceRowsLast readDQ gate
DNS records every zone's records, each field as the provider returns it58 of 5825 Oct 2026 13:53 UTCpasses
Provider audit log who changed which record and when1,014 of 1,01425 Oct 2026 13:53 UTCpasses
nginx on host-4b4dc1 each vhost file and setting, read over SSH14 of 1425 Oct 2026 13:53 UTCpasses
nginx on host-aa516a each vhost file and setting, read over SSH24 of 2425 Oct 2026 13:53 UTCpasses
Probes from outside the http, dns and tls answers of every served name111 of 11125 Oct 2026 13:54 UTCpasses

Probes at 25 Oct 2026 13:54 UTC: 20 of 111 fail (dns 3, http 10, tls 7); 11 probe runs and 0 verification runs pass the gate.

The failing names
  • dns: host-375750.ai, host-4c2c20.ai, host-f85201.ai
  • http: host-375750.ai, host-3f9d65.ai, host-3fef97.club, host-4c2c20.ai, host-50b116.com, host-922448.ai, host-c10fff.com, host-d07e8a.com, host-d8dbd3.ai, host-f85201.ai
  • tls: host-375750.ai, host-3f9d65.ai, host-3fef97.club, host-4c2c20.ai, host-922448.ai, host-d8dbd3.ai, host-f85201.ai

Copies: 112 at the vault's heads, 42 ok, 70 ok with gaps, 0 fail. A copy with gaps restores once the 34 dependencies its validation names are in place.

The 34 gaps
  • /etc/letsencrypt/live/host-17a03d.info/fullchain.pem
  • /etc/letsencrypt/live/host-17a03d.info/privkey.pem
  • /etc/letsencrypt/live/host-18efce.ai/fullchain.pem
  • /etc/letsencrypt/live/host-18efce.ai/privkey.pem
  • /etc/letsencrypt/live/host-492568.ai/fullchain.pem
  • /etc/letsencrypt/live/host-492568.ai/privkey.pem
  • /etc/letsencrypt/live/host-4c795e.quest/fullchain.pem
  • /etc/letsencrypt/live/host-4c795e.quest/privkey.pem
  • /etc/letsencrypt/live/host-503b27.ai/fullchain.pem
  • /etc/letsencrypt/live/host-503b27.ai/privkey.pem
  • /etc/letsencrypt/live/host-525a57.com/fullchain.pem
  • /etc/letsencrypt/live/host-525a57.com/privkey.pem
  • /etc/letsencrypt/live/host-9ac4f1.com/fullchain.pem
  • /etc/letsencrypt/live/host-9ac4f1.com/privkey.pem
  • /etc/letsencrypt/live/host-a00d2f.ai/fullchain.pem
  • /etc/letsencrypt/live/host-a00d2f.ai/privkey.pem
  • /etc/letsencrypt/live/host-c907ae.ai/fullchain.pem
  • /etc/letsencrypt/live/host-c907ae.ai/privkey.pem
  • /etc/letsencrypt/live/host-c9c1ae.club/fullchain.pem
  • /etc/letsencrypt/live/host-c9c1ae.club/privkey.pem
  • /etc/letsencrypt/live/host-f324df.com/fullchain.pem
  • /etc/letsencrypt/live/host-f324df.com/privkey.pem
  • /etc/letsencrypt/options-ssl-nginx.conf
  • /etc/letsencrypt/ssl-dhparams.pem
  • /etc/nginx/snippets/word-9af24b-api-key.conf
  • /etc/ssl/word-8173ec/origin.crt
  • /etc/ssl/word-8173ec/origin.key
  • host-2a9e77.net
  • host-4111e5.com
  • host-4f380d.com
  • host-61d6c2.net
  • host-9e9da4.net
  • host-9eff2c.com
  • host-c0f047.net

Every run passes the DQ gate: 61 of 61.

Look deeper