Agent Wranglers

APS-68Recommended

Remove DNS records you no longer use

Delete every DNS record that points at a server, bucket or hosted service you no longer own, before you give that resource up.

By Agent Wranglers. Updated .

How to do it

Keep the DNS zone in version control, or export it each month. When you shut down a cloud app, bucket or landing page, remove its DNS record first. A record left pointing at a freed name lets anyone claim it and serve pages on your subdomain. The new owner can then read cookies set for your whole domain and phish your users.

Examples

Shell example

dig +short CNAME shop.example.com        # example-shop.hosting.example.net.
dig +short example-shop.hosting.example.net   # must resolve
curl -s https://shop.example.com/ | grep -i "no such\|isn't a site\|not found"   # must print nothing

How to check

For every CNAME and A record in the zone, the target resolves and serves your own content. No target answers NXDOMAIN or a provider page such as "no such bucket" or "there isn't a site here".

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/dangling-dns">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.