---
title: "Remove DNS records you no longer use · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/dangling-dns
updated: 2026-10-20
licence: "All rights reserved"
---

# Remove DNS records you no longer use

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Delete every DNS record that points at a server, bucket or hosted service you no longer own, before you give that resource up.
- How: Keep the DNS zone in version control, or export it each month. When you shut down a cloud app, bucket or landing page, remove its DNS record first. A record left pointing at a freed name lets anyone claim it and serve pages on your subdomain. The new owner can then read cookies set for your whole domain and phish your users.
- Check: For every CNAME and A record in the zone, the target resolves and serves your own content. No target answers NXDOMAIN or a provider page such as "no such bucket" or "there isn't a site here".

Example:

```sh
dig +short CNAME shop.example.com        # example-shop.hosting.example.net.
dig +short example-shop.hosting.example.net   # must resolve
curl -s https://shop.example.com/ | grep -i "no such\|isn't a site\|not found"   # must print nothing
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/dangling-dns`.

- Previous: [Wait a few days before taking new releases](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/release-cooldown)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)