Administration
The audit trail, and how to export it
How do I export a DNS audit trail for a client or auditor?
Open Audit, filter by client and date range, and export. Every entry is hash-chained: each is sealed against the one before it, so altering or removing any record breaks the chain and verification reports exactly where. The export is per client, so you can hand it over without exposing anyone else.
# What tamper-evident means here
Each entry hashes its own content together with the previous entry's hash. Editing an entry changes its hash, which no longer matches what the next entry sealed, and so on to the end. Verification reports the first entry that fails and treats everything after it as untrustworthy.
# What is recorded
- Every change: who composed it, what it altered, what the checks found, who approved it.
- Every apply and its provider response.
- Every verification result, including failures.
- Sign-ins, provider connections, permission changes and setting changes.
Credentials never reach the audit trail. They are stripped by name before an entry is written, including the ones whose names do not look like secrets.
Thanks — noted.
Related
Raise a ticket from inside the platform and your tenant, plan and recent activity come attached automatically. A client currently offline is treated as urgent on every plan.