Evidence per finding

After this lesson you can

Record each finding so somebody else can verify it without repeating your work.

Assumes you have read A method you can run by hand.

A finding somebody cannot verify becomes an argument. Recording the query and its answer alongside every conclusion turns the conversation from whether you are right into what to do about it.

Per finding

FINDING    No CAA record on example.com
SURFACE    Identity
QUERY      dig +short CAA example.com
ANSWER     (empty)
OBSERVED   2026-09-15 14:22 UTC, resolver 1.1.1.1
MEANS      Any certificate authority may issue for this
           name, including for a subdomain an attacker
           controls via a dangling delegation.
FIX        example.com. CAA 0 issue "letsencrypt.org"
RISK OF FIX  Low. Pin the CA only; do not pin accounturi
           until every renewing client is known.
VERIFY     dig +short CAA example.com

Everything except MEANS is mechanical. The conclusion is the only part you are asserting, and it sits next to the evidence for it.

Why this specific shape

Field	Prevents
The exact query	A dispute about whether you checked the right thing.
The exact answer	A dispute about what was there at the time.
Time and resolver	A dispute caused by caching or by a change since.
What it means	A finding nobody acts on because the consequence was never stated.
The literal fix	A ticket that comes back asking what to publish.
The risk of the fix	The first question a competent owner asks, answered before they ask it.
The verification	An open finding nobody can close.

Keeping it proportionate

Generate it. The query and answer come from the same script that produced the assessment table.
Write MEANS once per finding type, not once per domain. Forty parked domains with no CAA is one finding with forty instances.
Group by fix, not by domain. The person applying it wants every domain needing the same record in one place.

Record the negative results too

“AXFR refused on all four nameservers, checked 2026-09-15” is worth recording precisely because it is not a finding. It is how next quarter’s assessment knows this was checked, and it is what lets you notice when a fifth nameserver appears without the transfer ACL the others carry.

Last reviewed 2026-09-15