How do you map the causal chain behind an internet-facing exposure?

Our platform only shows the public hostname and the vuln, then it turns into ticket ping pong because the DNS team, CDN team, BU cloud team, and vendor all say it is someone else. The hostname is not the root cause, so I am trying to standardize the evidence chain for DNS, CNAME, CDN config, reachable origin, affected component, org entity, and the control that must change. Still not sure why this is so messy