How Domain Records Are Authenticated

By Bill Hartzer, domain name expert witness·August 10, 2026

Authentication asks a narrow question

The question is not whether a record is true. It is whether there is enough to support a finding that the item is what its proponent says it is.

For domain records that distinction does a lot of work, because almost none of them were written by a person. A registration response is generated by a server. A passive DNS row is generated by sensors. A certificate log entry is generated by an append-only log. An archive capture is generated by a crawler. There is no author to call, so the foundation is built on the system: what it does, how it does it, and what its output actually represents.

That is why an expert who can describe a collection pipeline is doing evidentiary work rather than providing background color. It is also why the most common failure is not a legal one. It is a collection one: a screenshot of a lookup website, with no query, no responding server, no timestamp and no hash, is difficult to lay a foundation for because there is nothing in it that anyone can test.

Everything below describing the Federal Rules of Evidence is US-specific, and nothing here states how any court has applied or would apply them.

Process and system evidence

Rule 901(a) sets the standard: the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is. The illustrations that follow are non-exhaustive, and three of them recur in domain matters (FRE 901).

901(b)(1), testimony of a witness with knowledge, covers the expert who made the capture and can describe doing it.

901(b)(9), evidence describing a process or system and showing that it produces an accurate result, is the illustration that fits machine-produced records. For a certificate log this is unusually easy, because the standard itself describes a binary hash tree structure enabling proofs that the log is append-only and preventing retroactive insertion of entries (RFC 9162). For passive DNS it points at a description of the sensor and aggregation pipeline — collection at post-recursor points, capturing cache-fill responses, with no access to the querying client's address.

901(b)(4), distinctive characteristics taken together with all the circumstances, is the illustration most obviously suited to correlation-type infrastructure evidence, where a set of records is offered together rather than individually.

The certification routes

Two self-authentication provisions were added by amendments effective 1 December 2017, and both were drafted with electronic records in view (FRE 902).

Rule 902(13) covers a record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person. This is the route for machine-generated output: server responses, log extracts, system-produced reports.

Rule 902(14) covers data copied from an electronic device, storage medium or file, if authenticated by a process of digital identification, similarly certified. "A process of digital identification" is the language that makes a hash record part of the authentication path rather than housekeeping, and it is the reason hashes are computed at capture rather than at report time.

Both certifications must meet the requirements of Rule 902(11) or (12), and both carry 902(11)'s advance written notice requirement, which is a scheduling matter for counsel rather than a technical one.

The certification does not make the record accurate. It substitutes a certificate for live foundation testimony. Everything an opponent could say about what the record measures remains available.

Custodian records and the business-records route

Records produced by a registrar, registry, hosting provider or certificate authority are a different category from captures the expert made, and they authenticate differently.

Rule 803(6) sets out the conditions for records of a regularly conducted activity: made at or near the time by, or from information transmitted by, someone with knowledge; kept in the course of a regularly conducted activity; made as a regular practice; shown by custodian testimony or a certification; and subject to the opponent showing that the source of information or the circumstances indicate a lack of trustworthiness.

Two practical points follow for a domain matter. First, ask the producing custodian to certify the production and to state its retention periods and whether any responsive record has already been deleted — the absence of a record is itself a fact that needs explaining, and it explains differently if the record never existed than if it aged out.

Second, a report that mixes custodian productions and self-collected captures should mark which is which, because an examiner can describe the handling of one and not the other.

What each record type needs on its face

Different sources need different things preserved, and the differences are not cosmetic.

Registration data. The raw response — the structured JSON from RDAP, or legacy text — not a rendering. The exact query, the responding server, and a retrieval timestamp in a stated time zone. Query both the registry and registrar endpoints where both exist, since the response profile distinguishes them.

DNS. Which resolver answered, because answers vary by resolver and by geography. For passive DNS, the provider, the query string, the query time, and the raw export rather than a screenshot — and the first and last observation fields recorded as what they are, an observation window rather than a creation and deletion date.

Archive captures. The full capture URL including its fourteen-digit timestamp, which is recorded in GMT, plus the archived response, a rendered copy, and the capture index for the URL so the complete set of known capture dates is on the record and not only the convenient ones.

Certificates. The full certificate, its fingerprint, the complete name list, validity dates, the issuing authority, and each signed timestamp with its log.

What authentication does not prove

A foundation establishes what an item is. It does not establish what the item means, and conflating the two is where credible-looking domain evidence goes wrong.

A hash proves integrity since hashing. It shows a file has not changed since the digest was computed. It says nothing about whether the captured page, response or log was accurate when captured, or whether the source was authentic. Published guidance recommends more than one algorithm precisely because the guarantee is narrow.

A certificate log entry proves logging, not identity. The standard is explicit that transparency logging does not prevent misissuance; it makes issuance detectable. The entry shows a certificate covering a name was issued and logged at a time, not who requested it — and the certificate authority's validation records, which would answer that, are not in the log.

An archive capture proves retrievability, not publication. It does not establish when content was first published, how long it stayed up, who wrote it, or that a visitor saw what the crawler saw. Around one in five composite archived pages has been found to be both temporally coherent and completely intact, because embedded resources are often archived at different times than the page.

A custody log cannot cure non-reproducibility. Where a response depended on the visitor's location, device or credentials, a later attempt can legitimately differ; the log makes that explicit rather than fixing it.

Practice that survives examination

The routine is short, and the value is in doing it every time rather than in doing it elaborately.

Preserve the raw response, not the rendering, and preserve it alongside the rendering where a visual exhibit is needed.
Record the query, the endpoint and the timestamp with time zone — the workstation clock and its zone documented, not assumed.
Hash at capture, under more than one algorithm, into a manifest that travels with the set.
Keep an append-only collection log written as the work happens, recording the tool, the version, the operator, the action and the result.
Seal the original set and analyze only copies, re-verifying the originals before any re-examination.
Record failures and non-reproductions as carefully as successes, and log every item sought but not obtained with the reason.

Where an automated process performed the capture, note that the certification route addressed to records generated by an electronic process exists and that the process description is part of what makes it available. Whether to use it, and when to give notice, is for counsel.

Frequently Asked Questions

Does hashing a capture make it admissible?

No single step makes anything admissible, and admissibility is for the court. What a hash does is support the claim that a preserved file is the same file that was captured, which is the work that a process of digital identification does in the self-authentication provision addressed to copied data. It has to be computed at capture to do that work — a digest calculated after files have been renamed, re-saved, converted or emailed documents a later state, not the collected one.

Can passive DNS data be authenticated when it comes from a commercial provider?

The record is a third-party product, so the foundation runs through a description of how the system works: sensors collecting responses at post-recursor points, aggregation across contributing operators, and output fields with defined meanings including first and last observation timestamps. That description is what an expert supplies. Its limits are supplied at the same time: coverage depends on who contributed data and when, providers disagree because they have different sensors, and absence of an observation is not absence of a resolution.

What if a website looked different to the crawler than to a visitor?

That is a documented property of web content rather than an edge case. Responses can vary by visitor credentials, browser, location, date and time, and content can be served conditionally to search-engine crawlers. The consequence is that an archived capture evidences what was retrievable by that crawler at that moment. Where it matters, corroboration comes from elsewhere: contemporaneous captures made by the examiner, resolution history, certificate records, and the site operator's own server records obtained through process.

Is a certification from the record's holder always needed?

Not always, and there is more than one path. In United States federal practice a record can be authenticated by a witness with knowledge, by evidence describing the process or system that produced it, or by certification under the self-authentication provisions, which substitute a certificate for live foundation testimony and carry a notice requirement. Self-collected captures are typically authenticated by the examiner's own process description and contemporaneous log, while custodian productions usually come with the custodian's certification. Which route to use is a decision for counsel.

How do administrative domain proceedings treat authentication?

They apply no formal rules of evidence. In a UDRP the panel determines admissibility, relevance, materiality and weight, and decides on the papers, with no discovery and no cross-examination. The practical effect is that a poorly documented exhibit is not excluded — it is given less weight, without anyone saying so. Capture discipline still matters, because the same annexes are frequently re-used in a later court proceeding, which the Policy expressly preserves, and by then the live record has moved on.

What should a preservation copy of a web page contain?

The full HTTP response with headers rather than only the rendered page; the page source; a rendered copy as an image or document; the complete URL including protocol, host, path and any session information; the retrieval time with the local time zone recorded; the tool and version used; and a hash of each file computed at capture. Where the subject is a redirect, capture each hop discretely with redirect-following disabled, then again with it enabled, and record a screen recording, because a sequence cannot be shown in a still frame.