DNS points at things that are gone or unlisted

Checks

• Record points to unclaimed cloud resource record_points_to_unclaimed_cloud_resource
• Mail policy includes unused vendor spf_includes_vendor_no_longer_used
• Mail vendor missing from mail policy vendor_sending_mail_not_in_spf
• Strict DMARC with permissive mail policy dmarc_reject_with_permissive_spf
• Certificate rules forbid current issuer caa_forbids_the_issuer_of_the_current_certificate
• Mail record points to dead host mx_points_to_dead_host

Findings

• The CAA record does not allow the issuer of the certificate in use
• A DNS record points at a service that no longer answers, or mail records contradict each other
• The SPF record and the mail vendors in use do not match

What this relies on

Records outlive the services they were created for.

How to verify by hand

The DNS and mail provider consoles.