The compliance evidence package

For subscriptions that include it, CNX assembles a daily compliance evidence package alongside the DNS service itself — a second, read-only git repository that CNX writes to and your team mirrors. It gives a regulated customer — a bank, for instance — independent, self-contained evidence of change control and key custody for their own audits.

Each day's package includes:

• Activity logs — every zone and DNSSEC-related event CNX's platform recorded for your zones during the day, sourced from CNX's central logging platform.
• HSM key attestation — a cryptographically signed proof that the private key behind your zone's KSK was held inside CNX's protected key-management system at report time.
• An RFC 3161 timestamp — issued by CNX's own Timestamp Authority over a manifest of that day's report files, so the retention copy your team mirrors can be shown not to have been altered after the fact.

See Reports repository format for the exact file layout and schema, and Verifying report integrity for how to check the attestation and timestamp yourself.

For subscriptions that include telemetry, DNS operations and selected DNSSEC and distribution events are also delivered continuously over Kafka to your SIEM, including IBM QRadar collectors. See CNX Telemetry Feeds for connection instructions, source-time provenance, and the DNS event schemas. Daily reports and feeds have separate formats and retention behavior.