Supply chain and setup Required

Remove DNS records you no longer use

Delete every DNS record that points at a server, bucket or hosted service you no longer own, before you give that resource up.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Keep the DNS zone in version control, or export it each month. When you shut down a cloud app, bucket or landing page, remove its DNS record first. A record left pointing at a freed name lets anyone claim it and serve pages on your subdomain. The new owner can then read cookies set for your whole domain and phish your users.

Example

dig +short CNAME shop.example.com        # example-shop.hosting.example.net.
dig +short example-shop.hosting.example.net   # must resolve
curl -s https://shop.example.com/ | grep -i "no such\|isn't a site\|not found"   # must print nothing

How to check

For every CNAME and A record in the zone, the target resolves and serves your own content. No target answers NXDOMAIN or a provider page such as "no such bucket" or "there isn't a site here".

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/dangling-dns.