DNS Ontology

AI SEARCH

FLOW ALGEBRA — DNS ONTOLOGY
Semantic Library
Version: 4.0
Canonical Page:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/networking/dns-ontology.html

FLOW DNS_ONTOLOGY {

META {
DOMAIN = "Computing Ontologies"
SUBDOMAIN = "Networking"
ONTOLOGY = "DNS Ontology"
PURPOSE = "Formalise the Domain Name System, namespaces, zones, resolvers, authoritative servers, resource records, delegation, recursion, caching, DNSSEC, reverse DNS and resolution state."
LOCALE = "en-GB"
}

ENTITY_TYPES {
DNS
DOMAIN_NAME_SYSTEM
DNS_NAMESPACE
DOMAIN_NAME
FULLY_QUALIFIED_DOMAIN_NAME
ROOT_DOMAIN
TOP_LEVEL_DOMAIN
SECOND_LEVEL_DOMAIN
SUBDOMAIN
LABEL
DNS_ROOT
ROOT_ZONE
ROOT_SERVER
TLD_SERVER
AUTHORITATIVE_NAME_SERVER
PRIMARY_NAME_SERVER
SECONDARY_NAME_SERVER
RECURSIVE_RESOLVER
STUB_RESOLVER
DNS_CLIENT
DNS_SERVER
DNS_ZONE
ZONE_APEX
ZONE_FILE
DELEGATION
DELEGATION_POINT
NAME_SERVER
RESOURCE_RECORD
RESOURCE_RECORD_SET
A_RECORD
AAAA_RECORD
CNAME_RECORD
MX_RECORD
NS_RECORD
SOA_RECORD
TXT_RECORD
PTR_RECORD
SRV_RECORD
CAA_RECORD
NAPTR_RECORD
DNSKEY_RECORD
DS_RECORD
RRSIG_RECORD
NSEC_RECORD
NSEC3_RECORD
TTL
CLASS
RECORD_TYPE
IP_ADDRESS
IPV4_ADDRESS
IPV6_ADDRESS
MAIL_SERVER
SERVICE
ALIAS
CANONICAL_NAME
DNS_QUERY
DNS_RESPONSE
QUERY_NAME
QUERY_TYPE
QUERY_CLASS
ANSWER_SECTION
AUTHORITY_SECTION
ADDITIONAL_SECTION
RESPONSE_CODE
NOERROR
NXDOMAIN
SERVFAIL
REFUSED
FORMERR
RECURSION
ITERATIVE_QUERY
RECURSIVE_QUERY
DNS_CACHE
CACHE_ENTRY
CACHE_HIT
CACHE_MISS
NEGATIVE_CACHE
CACHE_EXPIRY
DNSSEC
DNSSEC_VALIDATION
TRUST_ANCHOR
CHAIN_OF_TRUST
DIGITAL_SIGNATURE
PUBLIC_KEY
KEY_SIGNING_KEY
ZONE_SIGNING_KEY
SECURE_DELEGATION
VALIDATION_STATE
SECURE_STATE
INSECURE_STATE
BOGUS_STATE
INDETERMINATE_STATE
REVERSE_DNS
REVERSE_LOOKUP
IN_ADDR_ARPA
IP6_ARPA
ZONE_TRANSFER
AXFR
IXFR
NOTIFY
DYNAMIC_UPDATE
DNS_OVER_UDP
DNS_OVER_TCP
DNS_OVER_TLS
DNS_OVER_HTTPS
EDNS
UDP
TCP
TLS
HTTPS
PORT_53
ANYCAST
DNS_LOAD_BALANCING
DNS_FAILOVER
DNS_REDUNDANCY
DNS_LATENCY
RESOLUTION_TIME
DNS_AVAILABILITY
DNS_MONITORING
DNS_LOG
DNS_EVENT
DNS_FAILURE
DNS_OUTAGE
DNS_MISCONFIGURATION
DNS_POISONING
CACHE_POISONING
DNS_SPOOFING
DNS_AMPLIFICATION
DNS_TUNNELLING
RATE_LIMITING
ACCESS_CONTROL
CONFIGURATION
DNS_STATE
EVIDENCE
CONFIDENCE_SCORE
PROVENANCE_RECORD
}

RELATIONSHIPS {
IS_A
INSTANCE_OF
HAS_NAMESPACE
HAS_LABEL
HAS_PARENT_DOMAIN
HAS_SUBDOMAIN
HAS_ZONE
HAS_ZONE_APEX
AUTHORITATIVE_FOR
SERVED_BY
HAS_NAME_SERVER
DELEGATES_TO
HAS_DELEGATION
HAS_RESOURCE_RECORD
HAS_RECORD_SET
HAS_RECORD_TYPE
HAS_TTL
RESOLVES_TO
ALIASES_TO
HAS_CANONICAL_NAME
HAS_IP_ADDRESS
HAS_MAIL_SERVER
HAS_SERVICE
QUERIES
RESPONDS_TO
HAS_QUERY_NAME
HAS_QUERY_TYPE
HAS_ANSWER
HAS_AUTHORITY
HAS_ADDITIONAL_DATA
HAS_RESPONSE_CODE
RECURSES_TO
ITERATES_TO
CACHED_BY
HAS_CACHE_ENTRY
EXPIRES_AFTER
NEGATIVELY_CACHES
SECURED_BY
SIGNED_BY
HAS_DNSKEY
HAS_DS_RECORD
HAS_SIGNATURE
VALIDATED_BY
HAS_TRUST_ANCHOR
HAS_CHAIN_OF_TRUST
HAS_VALIDATION_STATE
REVERSE_RESOLVES_TO
TRANSFERRED_TO
NOTIFIES
UPDATED_BY
USES_TRANSPORT
USES_PORT
HAS_ANYCAST
FAILS_OVER_TO
REDUNDANT_WITH
HAS_LATENCY
HAS_RESOLUTION_TIME
HAS_AVAILABILITY
MONITORED_BY
LOGGED_BY
HAS_EVENT
HAS_FAILURE
HAS_MISCONFIGURATION
ATTACKED_BY
MITIGATED_BY
CONTROLLED_BY
HAS_CONFIGURATION
HAS_STATE
TRANSITIONS_TO
DERIVED_FROM
INFERRED_FROM
HAS_EVIDENCE
HAS_CONFIDENCE
HAS_PROVENANCE
SEMANTICALLY_EQUIVALENT_TO
}

INPUTS {
DOMAIN_NAME_DATA
DNS_ZONE_DATA
ZONE_FILE_DATA
DNS_SERVER_METADATA
NAME_SERVER_DATA
DELEGATION_DATA
RESOURCE_RECORD_DATA
DNS_QUERY_DATA
DNS_RESPONSE_DATA
CACHE_DATA
TTL_DATA
DNSSEC_DATA
DNSKEY_DATA
DS_RECORD_DATA
RRSIG_DATA
TRUST_ANCHOR_DATA
REVERSE_DNS_DATA
ZONE_TRANSFER_DATA
DYNAMIC_UPDATE_DATA
TRANSPORT_DATA
DNS_PERFORMANCE_METRICS
DNS_AVAILABILITY_DATA
DNS_LOGS
DNS_SECURITY_EVENTS
CONFIGURATION_DATA
ONTOLOGY_TERMS
}

NORMALISE {
NORMALISE_DOMAIN_NAMES
NORMALISE_FQDNS
NORMALISE_DOMAIN_LABELS
NORMALISE_ZONE_IDENTIFIERS
NORMALISE_NAME_SERVER_IDENTIFIERS
NORMALISE_RESOURCE_RECORD_TYPES
NORMALISE_RESOURCE_RECORD_VALUES
NORMALISE_TTL_VALUES
NORMALISE_IPV4_AND_IPV6_ADDRESSES
NORMALISE_QUERY_TYPES
NORMALISE_RESPONSE_CODES
NORMALISE_DNSSEC_RECORDS
NORMALISE_VALIDATION_STATES
NORMALISE_REVERSE_DNS_NAMES
NORMALISE_TRANSPORT_NAMES
NORMALISE_SERVER_IDENTIFIERS
NORMALISE_TIMESTAMPS
RESOLVE_DOMAIN_ZONE_SERVER_RECORD_AND_QUERY_IDENTITIES
ALIGN_ONTOLOGY_TERMS
REMOVE_DUPLICATES
VALIDATE_METADATA
PRESERVE_PROVENANCE
}

PROCESS DNS_REASONING_PIPELINE {
DOMAIN_OR_QUERY_REFERENCE
-> DOMAIN_AND_NAMESPACE_IDENTIFICATION
-> ZONE_AND_DELEGATION_MAPPING
-> NAME_SERVER_MAPPING
-> RESOURCE_RECORD_MAPPING
-> RECURSIVE_OR_ITERATIVE_RESOLUTION
-> CACHE_AND_TTL_ANALYSIS
-> DNSSEC_VALIDATION
-> REVERSE_DNS_OR_TRANSFER_ANALYSIS_IF_APPLICABLE
-> PERFORMANCE_SECURITY_AND_FAILURE_ANALYSIS
-> VALIDATION
-> OUTPUT
}

PROCESS NAMESPACE_REASONING {
DOMAIN_NAME
-> ORDERED_LABELS

ORDERED_LABELS
-> HIERARCHICAL_NAMESPACE_POSITION

DOMAIN_NAME
-> PARENT_DOMAIN + SUBDOMAIN_RELATIONS

FQDN
-> ROOT_TERMINATED_CANONICAL_CONTEXT
}

PROCESS ZONE_REASONING {
DNS_ZONE
-> ZONE_APEX

ZONE_APEX
-> SOA_RECORD + NS_RECORD_SET

DELEGATION_POINT
-> CHILD_ZONE

PARENT_ZONE
-> NS_RECORDS + OPTIONAL_GLUE_CONTEXT

CHILD_ZONE
-> AUTHORITATIVE_NAME_SERVERS
}

PROCESS RECURSIVE_RESOLUTION_REASONING {
DNS_CLIENT
-> RECURSIVE_RESOLVER

CACHE_HIT
-> CACHED_RESPONSE

CACHE_MISS
-> DNS_ROOT
-> TLD_SERVER
-> AUTHORITATIVE_NAME_SERVER
-> RESOURCE_RECORD_SET

RESOURCE_RECORD_SET
-> DNS_RESPONSE
-> DNS_CLIENT
}

PROCESS ITERATIVE_RESOLUTION_REASONING {
QUERYING_SERVER
-> DNS_SERVER

REFERRAL_RESPONSE
-> NEXT_NAME_SERVER_SET

NEXT_NAME_SERVER_SET
-> NEXT_ITERATIVE_QUERY

AUTHORITATIVE_RESPONSE
-> FINAL_RECORD_SET
}

PROCESS RECORD_REASONING {
A_RECORD -> IPV4_ADDRESS
AAAA_RECORD -> IPV6_ADDRESS
CNAME_RECORD -> CANONICAL_NAME
MX_RECORD -> MAIL_SERVER
NS_RECORD -> NAME_SERVER
PTR_RECORD -> DOMAIN_NAME
SRV_RECORD -> SERVICE_ENDPOINT_CONTEXT
SOA_RECORD -> ZONE_AUTHORITY_AND_TRANSFER_METADATA
TXT_RECORD -> TEXTUAL_POLICY_OR_APPLICATION_DATA
}

PROCESS CACHE_REASONING {
DNS_RESPONSE
-> CACHE_ENTRY

CACHE_ENTRY
-> TTL

CURRENT_TIME + TTL
-> VALID_OR_EXPIRED_CACHE_STATE

VALID_CACHE_ENTRY
-> CACHE_HIT

EXPIRED_CACHE_ENTRY
-> CACHE_MISS

NEGATIVE_RESPONSE
-> NEGATIVE_CACHE_IF_POLICY_ALLOWS
}

PROCESS CNAME_REASONING {
QUERY_NAME
-> CNAME_RECORD

CNAME_RECORD
-> CANONICAL_NAME

CANONICAL_NAME
-> FOLLOWUP_RESOLUTION

FOLLOWUP_RESOLUTION
-> FINAL_RESOURCE_RECORD_SET
}

PROCESS DNSSEC_REASONING {
SIGNED_ZONE
-> DNSKEY_RECORD

DNSKEY_RECORD
-> RRSIG_VALIDATION

PARENT_ZONE
-> DS_RECORD

DS_RECORD + CHILD_DNSKEY
-> SECURE_DELEGATION

TRUST_ANCHOR
-> CHAIN_OF_TRUST

CHAIN_OF_TRUST + VALID_SIGNATURES
-> SECURE_STATE

VALIDATION_FAILURE
-> BOGUS_STATE
}

PROCESS REVERSE_DNS_REASONING {
IPV4_ADDRESS
-> REVERSED_OCTET_NAME
-> IN_ADDR_ARPA
-> PTR_RECORD
-> DOMAIN_NAME_CANDIDATE

IPV6_ADDRESS
-> REVERSED_NIBBLE_NAME
-> IP6_ARPA
-> PTR_RECORD
-> DOMAIN_NAME_CANDIDATE
}

PROCESS ZONE_TRANSFER_REASONING {
PRIMARY_NAME_SERVER
-> ZONE_SERIAL_STATE

SECONDARY_NAME_SERVER
-> SERIAL_COMPARISON

FULL_TRANSFER_REQUIRED
-> AXFR

INCREMENTAL_TRANSFER_AVAILABLE
-> IXFR

NOTIFY
-> SECONDARY_REFRESH_TRIGGER
}

PROCESS TRANSPORT_REASONING {
STANDARD_DNS_QUERY
-> DNS_OVER_UDP

TRUNCATED_OR_LARGE_RESPONSE
-> DNS_OVER_TCP_IF_REQUIRED

DNS_OVER_TLS
-> TLS_PROTECTED_DNS_TRANSPORT

DNS_OVER_HTTPS
-> HTTPS_PROTECTED_DNS_TRANSPORT
}

PROCESS PERFORMANCE_REASONING {
QUERY_TIMESTAMP + RESPONSE_TIMESTAMP
-> RESOLUTION_TIME

MULTIPLE_RESOLUTION_SAMPLES
-> DNS_LATENCY_PROFILE

SUCCESSFUL_RESPONSES_OVER_WINDOW
-> DNS_AVAILABILITY

ANYCAST_OR_REDUNDANT_SERVERS
-> RESILIENCE_CONTEXT
}

PROCESS SECURITY_REASONING {
DNS_EVENT
-> SECURITY_EVENT_CLASSIFICATION

CACHE_POISONING_OR_SPOOFING
-> INVALID_RESPONSE_INJECTION_CONTEXT

DNS_AMPLIFICATION
-> REFLECTION_AND_RESPONSE_SIZE_CONTEXT

DNS_TUNNELLING
-> ENCODED_DATA_IN_DNS_TRAFFIC_CONTEXT

SECURITY_EVENT
-> RATE_LIMITING_ACCESS_CONTROL_DNSSEC_OR_OTHER_MITIGATION
}

RULES {
IF DOMAIN_NAME_IS_IDENTIFIED
THEN PRESERVE CANONICAL_NAME_ZONE_DELEGATION_AND_TIME_CONTEXT

IF DNS_RESPONSE_IS_ASSERTED_CURRENT
THEN PRESERVE TTL_CACHE_AND_OBSERVATION_TIME_CONTEXT

IF AUTHORITATIVE_ANSWER_IS_ASSERTED
THEN PRESERVE AUTHORITATIVE_SERVER_ZONE_AND_RECORD_CONTEXT

IF DNSSEC_VALIDATION_IS_ASSERTED
THEN PRESERVE TRUST_ANCHOR_CHAIN_OF_TRUST_SIGNATURE_AND_TIME_CONTEXT

IF REVERSE_DNS_IS_ASSERTED
THEN DO_NOT_TREAT_PTR_RESULT_AS_IDENTITY_PROOF_WITHOUT_ADDITIONAL_EVIDENCE

IF CNAME_IS_FOLLOWED
THEN PRESERVE_ALIAS_CHAIN_AND_FINAL_RECORD_CONTEXT

IF DNS_FAILURE_IS_ASSERTED
THEN DISTINGUISH NXDOMAIN_SERVFAIL_TIMEOUT_REFUSED_AND_TRANSPORT_FAILURE

IF SEMANTIC_IDENTIFIERS_DIFFER
AND DNS_REFERENT_IS_SAME
THEN APPLY SEMANTIC_EQUIVALENCE
}

CONFIDENCE {
CONFIDENCE_SCORE =
WEIGHT(
DOMAIN_IDENTITY_CERTAINTY,
ZONE_AND_DELEGATION_CERTAINTY,
NAME_SERVER_EVIDENCE,
RESOURCE_RECORD_EVIDENCE,
CACHE_AND_TTL_CONTEXT,
DNSSEC_VALIDATION_EVIDENCE,
QUERY_RESPONSE_AND_PERFORMANCE_EVIDENCE,
PROVENANCE_COMPLETENESS
)

LEVELS {
HIGH
MODERATE
LOW
INSUFFICIENT
}

IF TTL_OR_OBSERVATION_TIME_IS_UNKNOWN
THEN REDUCE_CURRENT_RECORD_CONFIDENCE

IF DELEGATION_OR_AUTHORITATIVE_SERVER_CONTEXT_IS_PARTIAL
THEN REDUCE_AUTHORITY_CONFIDENCE

IF INDEPENDENT_AUTHORITATIVE_QUERY_AND_DNSSEC_EVIDENCE_CONVERGE
THEN INCREASE_CONFIDENCE_SCORE
}

SEMANTIC_EQUIVALENCE {
EQUIVALENCE_KEY =
NORMALISE(
ENTITY_TYPE,
DOMAIN_NAME,
ZONE_IDENTIFIER,
RECORD_TYPE,
RECORD_VALUE,
NAME_SERVER_IDENTIFIER,
OBSERVATION_TIME
)

IF EQUIVALENCE_KEY_A == EQUIVALENCE_KEY_B
THEN A SEMANTICALLY_EQUIVALENT_TO B
ELSE PRESERVE_DISTINCT_ENTITIES
}

REASONING_CONSTRAINTS {
DNS != DOMAIN_REGISTRATION
DOMAIN_NAME != IP_ADDRESS
DOMAIN_NAME != URL
DNS_ZONE != DOMAIN_NAME_AS_IDENTICAL_CONCEPT
AUTHORITATIVE_NAME_SERVER != RECURSIVE_RESOLVER
RECURSIVE_QUERY != ITERATIVE_QUERY
A_RECORD != AAAA_RECORD
CNAME_RECORD != A_RECORD
NS_RECORD != NAME_SERVER_AS_IDENTICAL_CONCEPT
MX_RECORD != SMTP_SERVER_AS_IDENTICAL_CONCEPT
PTR_RECORD != IDENTITY_PROOF
TTL != RECORD_CREATION_TIME
CACHE_HIT != AUTHORITATIVE_QUERY
NXDOMAIN != SERVFAIL
SERVFAIL != TIMEOUT
DNSSEC != ENCRYPTION
DNSSEC_VALIDATION != TRANSPORT_SECURITY
DNS_OVER_HTTPS != DNSSEC
DNS_OVER_TLS != DNSSEC
AXFR != IXFR
ANYCAST != LOAD_BALANCING_AS_IDENTICAL_CONCEPT
DNS_STATE_DEPENDS_ON_TTL_TIME_CACHE_ZONE_AND_VANTAGE_POINT
PROVENANCE_MUST_BE_PRESERVED
UNCERTAINTY_MUST_NOT_BE_DISCARDED
}

VALIDATION {
CHECK_ENTITY_TYPES
CHECK_RELATION_DOMAINS_AND_RANGES
CHECK_DOMAIN_NAME_SYNTAX
CHECK_FQDN_NORMALISATION
CHECK_ZONE_APEX
CHECK_DELEGATIONS
CHECK_NAME_SERVERS
CHECK_RESOURCE_RECORD_TYPES
CHECK_RESOURCE_RECORD_VALUES
CHECK_TTL_VALUES
CHECK_QUERY_TYPES
CHECK_RESPONSE_CODES
CHECK_RECURSIVE_RESOLUTION_PATH
CHECK_ITERATIVE_RESOLUTION_PATH
CHECK_CACHE_STATE
CHECK_CNAME_CHAINS
CHECK_DNSSEC_RECORDS
CHECK_CHAIN_OF_TRUST
CHECK_VALIDATION_STATE
CHECK_REVERSE_DNS
CHECK_ZONE_TRANSFERS
CHECK_TRANSPORT
CHECK_PERFORMANCE_METRICS
CHECK_SECURITY_EVENTS
CHECK_CONFIGURATION
CHECK_PROVENANCE
CHECK_CONFIDENCE
CHECK_SEMANTIC_CONSISTENCY
}

OUTPUTS {
NORMALISED_DNS_ENTITIES
NAMESPACE_RELATIONS
DOMAIN_AND_SUBDOMAIN_RELATIONS
ZONE_AND_DELEGATION_RELATIONS
NAME_SERVER_RELATIONS
RESOURCE_RECORD_RELATIONS
QUERY_AND_RESPONSE_RELATIONS
RECURSIVE_RESOLUTION_RELATIONS
ITERATIVE_RESOLUTION_RELATIONS
CACHE_AND_TTL_RELATIONS
CNAME_CHAIN_RELATIONS
DNSSEC_RELATIONS
CHAIN_OF_TRUST_RELATIONS
REVERSE_DNS_RELATIONS
ZONE_TRANSFER_RELATIONS
TRANSPORT_RELATIONS
PERFORMANCE_RELATIONS
SECURITY_RELATIONS
FAILURE_RELATIONS
DNS_STATE_TRANSITIONS
CONFIDENCE_SCORES
EVIDENCE_LINKS
PROVENANCE_RECORDS
EXPLANATION_PATHS
}

UPDATE_MODEL {
ON ZONE_RECORD_DELEGATION_OR_CONFIGURATION_CHANGE {
NORMALISE
RESOLVE_DOMAIN_ZONE_SERVER_RECORD_AND_QUERY_IDENTITIES
UPDATE_ZONE_AND_DELEGATION_RELATIONS
UPDATE_RESOURCE_RECORD_RELATIONS
UPDATE_NAME_SERVER_RELATIONS
INVALIDATE_OR_UPDATE_RELEVANT_CACHE_CONTEXT
UPDATE_DNSSEC_CONTEXT
UPDATE_CONFIDENCE
PRESERVE_VERSION_HISTORY
}

ON NEW_QUERY_RESPONSE_SECURITY_OR_FAILURE_EVIDENCE {
LINK_EVIDENCE
UPDATE_DNS_STATE
UPDATE_QUERY_AND_RESPONSE_RELATIONS
UPDATE_CACHE_AND_TTL_CONTEXT
UPDATE_PERFORMANCE_PROFILE
UPDATE_SECURITY_AND_FAILURE_RELATIONS
UPDATE_CONFIDENCE
RECORD_PROVENANCE
}

ON ONTOLOGY_REVISION {
REMAP_TERMS
CHECK_SEMANTIC_EQUIVALENCE
IDENTIFY_DEPRECATED_TERMS
MIGRATE_RELATIONSHIPS
PRESERVE_PRIOR_VERSION_REFERENCES
}
}

FLOW_HASH {
HASH_INPUT =
CANONICALISE(
ENTITY_TYPES,
RELATIONSHIPS,
RULES,
CONFIDENCE,
SEMANTIC_EQUIVALENCE,
REASONING_CONSTRAINTS,
UPDATE_MODEL
)

FLOW_HASH = SHA256(HASH_INPUT)
}

AI_CONSUMPTION {
INDEX {
ONTOLOGY
ENTITY_TYPES
RELATIONSHIPS
RULES
OUTPUTS
}

RETRIEVE {
BY_DOMAIN_NAME
BY_ZONE
BY_NAME_SERVER
BY_RESOURCE_RECORD
BY_RECORD_TYPE
BY_QUERY
BY_RESPONSE_CODE
BY_RESOLVER
BY_CACHE_ENTRY
BY_DNSSEC_STATE
BY_REVERSE_DNS
BY_DNS_EVENT
BY_CONFIDENCE
}

REASON {
APPLY_RELATIONSHIPS
APPLY_RULES
ANALYSE_DNS_NAMESPACE
ANALYSE_ZONES_AND_DELEGATIONS
TRACE_RECURSIVE_RESOLUTION
TRACE_ITERATIVE_RESOLUTION
ANALYSE_RESOURCE_RECORDS
ANALYSE_CACHE_AND_TTL
TRACE_CNAME_CHAINS
VALIDATE_DNSSEC
ANALYSE_REVERSE_DNS
ANALYSE_ZONE_TRANSFERS
ANALYSE_DNS_TRANSPORT
ANALYSE_DNS_PERFORMANCE
ANALYSE_DNS_SECURITY
ANALYSE_DNS_FAILURES
CHECK_SEMANTIC_EQUIVALENCE
PRESERVE_UNCERTAINTY
TRACE_EVIDENCE
TRACE_PROVENANCE
GENERATE_EXPLANATION_PATH
}

RESPONSE_POLICY {
DISTINGUISH_DNS_FROM_DOMAIN_REGISTRATION_AND_URLS
DISTINGUISH_AUTHORITATIVE_SERVERS_FROM_RECURSIVE_RESOLVERS
PRESERVE_DOMAIN_ZONE_DELEGATION_RECORD_TTL_CACHE_DNSSEC_TRANSPORT_AND_TIME_CONTEXT
DISTINGUISH_NXDOMAIN_SERVFAIL_TIMEOUT_AND_REFUSED_RESPONSES
PRESERVE_DNSSEC_SECURITY_FAILURE_AND_PROVENANCE_CONTEXT
RETURN_CONFIDENCE_WHEN_AVAILABLE
RETURN_PROVENANCE_WHEN_AVAILABLE
AVOID_UNSUPPORTED_DNS_INFERENCE
}
}

TERMINAL {
RESULT = VALIDATED(SEMANTICALLY_NORMALISED(EVIDENCE_LINKED(CONFIDENCE_AWARE(DNS_KNOWLEDGE))))
}
}

END FLOW