Host Overrides: Pin Hosts to Specific IPs

Configure host-to-IP overrides so Guard can scan hosts that do not resolve correctly from its scanning vantage point, with IP ownership verification and a full audit trail.

Host Overrides: Pin Hosts to Specific IPs

Some hosts resolve differently inside a customer's network than they do on the public internet. Common causes include split-horizon DNS configurations, internal address ranges that are only accessible via specific resolvers, and hosts whose public DNS records point to private or loopback addresses.

Host overrides let you pin a hostname to a specific IP address so Guard can scan these hosts from its scanning infrastructure, without changing how the asset is represented or how scan traffic is structured. Each override is verified for IP ownership and every change is recorded with a full audit trail.

How it works

When a hostname has a pinned IP configured, Guard's web scanning pipeline connects the underlying socket to the pinned IP instead of relying on DNS resolution. Everything above the socket layer is unchanged:

  • The hostname in the target URL is preserved.
  • The Host header sent in HTTP requests continues to use the hostname, maintaining virtual-host routing.
  • The TLS SNI value is the hostname, so certificate matching and TLS negotiation behave as expected.

The override is applied transparently beneath the URL- and hostname-keyed web pipeline, so the asset appears in Guard exactly as it would for any other host.

IP ownership verification

Before a pin takes effect, Guard checks whether the target IP belongs to your infrastructure using the Correlation Engine. The engine performs cloud range checks and credential-based verification.

  • If the IP is confirmed as belonging to your infrastructure, the pin takes effect immediately.
  • If the IP cannot be verified, Guard requires you to explicitly acknowledge the pin before it takes effect. This acknowledgment is recorded in the audit trail alongside the override entry.

Audit trail

Every create, update, and delete action on a host override is durably recorded with attribution to the individual user who made the change. The audit trail is available to account administrators and is retained beyond the current session.

Supported scenarios

Scenario

Description

Unresolvable hosts

Hosts with no public DNS record, or whose records have been removed, but which are still reachable at a known IP.

Split-horizon DNS

Hosts that resolve to an internal IP on the customer network but return no record (or an unreachable record) from Guard's resolver.

Mis-resolving hosts

Hosts whose public DNS returns a private or incorrect IP from Guard's resolver vantage point.

Manage host overrides

Host overrides are managed directly in the Guard UI. No account team involvement is required.

  1. Go to Settings > Scanning.
  2. Locate the Host Overrides section.
  3. Use the controls to add, edit, or delete host→IP pin entries.

Provide the following for each override:

  • Hostname — the fully qualified domain name as it appears in your Guard asset inventory (e.g., internal.example.com).
  • IP address — the IPv4 or IPv6 address Guard should connect to when scanning that hostname.

If the target IP cannot be verified as belonging to your infrastructure, you will be prompted to acknowledge the override before it is saved.

Considerations

  • Host overrides do not alter the asset record. The hostname, not the pinned IP, is the canonical identifier for the asset in Guard.
  • Overrides apply only to Guard's scanning pipeline. They have no effect on how your DNS is configured or how other systems resolve these hosts.
  • If the pinned IP becomes unreachable, the host will appear unreachable in scan results, the same as any other connectivity failure.
  • Supply only IPs that are within scope and that you are authorized to scan.
  • Pins for unverified IPs require explicit acknowledgment; that acknowledgment is recorded in the audit trail.