How can I tell which infrastructure served a website at a particular time?¶

Reconstruct the route for the exact hostname and timestamp. Current DNS describes the present arrangement, not what handled an earlier request.

Combine timed sources¶

Historic DNS can show addresses and aliases observed around the event. Nameserver history identifies who controlled authoritative DNS. Certificate records may show hostnames configured on a service. CDN, reverse-proxy, tunnel or dynamic-DNS records can reveal forwarding to an origin.

Hosting and cloud assignment records can then connect an address or resource to a customer during the relevant period. Platform logs, server logs or captured response headers may show which service actually answered.

Think of the result as a route map assembled from checkpoints. No single checkpoint necessarily records the entire journey.

Time resolution matters. A DNS database observed yesterday and tomorrow may miss a change lasting several hours. Cached answers can also persist after configuration changes. State the precision and gap of each source.

Build a table or timeline listing timestamp, hostname, technical result, provider layer and source. Separate observed facts from inferences and identify unresolved intermediaries.