How dangling DNS records appear

  • A cloud app, storage bucket or CDN endpoint is deleted, but the CNAME pointing to it stays in the zone.
  • A cloud virtual machine is shut down and its public IP address is released back to the provider, while an A record still points to it.
  • A delegated zone's name servers are cancelled, leaving NS records pointing at a provider where anyone could recreate the zone.
  • A supplier or agency hosted a site for you, the contract ended, and nobody updated DNS.

Why dangling DNS matters

A dangling record is an open invitation. If the resource name or IP address can be claimed by someone else, that person controls what your subdomain serves. This leads to subdomain takeover, phishing on your real domain and theft of cookies scoped to the parent domain. Released cloud IP addresses are reassigned to other customers, so A records pointing at them can end up serving another company's content.

How to find and fix dangling DNS

  1. Export your DNS zones and resolve every record.
  2. Check that each target still exists and belongs to you.
  3. Delete records for retired services, and make DNS clean-up part of every decommissioning checklist.
  4. Monitor continuously, because new dangling records appear whenever services change.

How DarkInvader helps

DarkInvader monitors your domains' DNS records alongside discovered subdomains, highlights records pointing at services or IP addresses that no longer belong to you, and tracks DNS changes so you can clean them up quickly.

Explore DNS Monitoring

Frequently asked questions

Is a dangling DNS record a vulnerability?

Yes, if the resource it points to can be claimed by someone else. Even when it cannot, it is still poor hygiene, because it adds confusion to the inventory and may become exploitable if the provider changes its rules.

What is the difference between dangling DNS and subdomain takeover?

Dangling DNS is the condition: a record pointing at something you no longer control. Subdomain takeover is the attack: someone claiming that resource and using your subdomain.

Can dangling DNS affect email?

Yes. Stale MX or SPF entries that reference services you no longer use can, in some configurations, let another party send or receive mail that appears to come from your domain.

Related terms and reading

Sources