Incident Overview
A customer-facing hostname intermittently resolves to an old service address. One alert says the authoritative DNS answer is healthy, while another reports failures through a recursive resolver.
Application health checks aimed directly at the current service address pass. The fictional impact affects a subset of clients, so the exercise classifies it as SEV-2.The immediate objective is not to guess which alert is correct.
It is to identify where answers diverge, contain exposure without altering DNS state, and define the evidence needed before recovery. Stop and escalate if the checks cannot be run in isolation, if access would exceed read-only permissions, or if the impact expands beyond the bounded scenario.
Investigation Options
Review the available operational moves and select the best immediate action.
Freeze DNS changes, preserve the observations and compare the authoritative answer with each recursive path using read-only queries.
Edit the authoritative record again so its value is reasserted.
Flush every resolver cache immediately.
Disable DNS monitoring because the alerts conflict.