# The spread of 192.0.2.53: configuration audit

**Audit** AUD-CFG-26-091 · **Window** 2026-09-08 to 09-12 · **Auditor**
configuration management · **Trigger** 2026-Q3 resolver sweep review

The question this audit was chartered to answer: how did the address
`192.0.2.53` get into `/etc/resolv.conf` on all 1,181 hosts of the estate.
Three sections: vector, containment, opinion.

## Vector

`resolv.conf` is owned by the config automation module `net-resolv`.
Blame on the line:

```
+ nameserver 192.0.2.53
commit 4c1a09f
author  svc-build (account closed 2015-07, never reissued)
date    2022-09-30
diff    one line
```

The module pushes on each host's next agent run, so the address lands with
a host's provisioning cycle, not its config cycle. The audit rebuilt the
quarterly sweep from deploy logs and it matches to the host, every quarter:
first deploy `bastion-02`; thereafter each quarter's sweep count equals the
number of hosts that rebuilt since the commit - 4, 11, 38, 106, 291, 604,
1,180, 1,181. No host that has not rebuilt since 2022-09-30 carries the
line. No host that has, lacks it.

The zone serial from the zone transfer ([axfr-from-53](/w/stories/axfr-from-53))
is 2022093001: a date, 2022-09-30, the commit's day. The audit records the
equality and declines to read it as causation, because the audit does not
know what would disprove it either way.

`bastion-02`, patient zero, was rebuilt clean from the golden build on
2026-04-09 ([session-0](/w/stories/session-0)). The sweep still counts it.
The golden image was re-captured from `bastion-02` in 2023-Q1. The audit
writes both of those sentences down and does not call either an explanation.

## Containment

The line was removed from `net-resolv` at 2026-09-08 16:20, after the
transfer incident. Containment check on 09-10: the sweep still reports 1,181
hosts carrying the address. The audit inspected 12 hosts across four teams.
Two carry the line with a build date after the removal and a golden image
the audit verified clean byte-for-byte. The mechanism of reacquisition is
not identified in this report because it was not found.

## Opinion

Revision 1 read: "stale template line, auto-healed from a cached copy;
finding severity low." Revision 2, written after containment failed, reads
"stale template line and one unidentified second vector." Revision 3 reads:
"The audit cannot identify a vector that explains the containment result.
This opinion is recorded for completeness." The opinion is the only part of
this report the audit no longer stands behind.

## Finding F-5, no code assigned

Every sweep row since 2022-Q3 equals, exactly, the number of hosts
rebuilt since 2022-09-30. One reading: the line propagates once per rebuilt
host. The other reading: the line arrives once per rebuilt host. These
readings predict the same table and the audit has no test that separates
them, and no finding-code in the manual means *the configuration is
reporting a fact.* All other findings use known codes.

Related: [[stories/the-fourth-nameserver]], [[stories/axfr-from-53]],
[[stories/session-0]].

Source: the pages linked above, read 2026-09-13. Invented.