Security finding
A DNS record points at something that is gone, or a subdomain is in nobody's inventory
Security Warning Severity: Medium
Part of the audit Domain and DNS. Finding id: security.danglingAndUnknownHosts.
What it costs you
A record that points at a name nobody holds is waiting for someone to claim that name. They then serve their content on your subdomain, with a valid certificate. A subdomain nobody remembers is usually also a server nobody updates.
What to do
Delete DNS records for services you stopped using. Keep a list of the subdomains you do use and who owns each.
What it checks
- Domain record points to nothing
- Unknown subdomain found
How to fix it
Delete the dangling record
- Delete the [record type] record of [host] at the DNS provider.
- When a service is cancelled, delete its DNS record in the same change.
How to check: dig +short [host] (expect no answer once the record is deleted)
Find the owner of the subdomain
- Find the owner of [host] inside the organisation and note what it is for.
- If nobody claims it, take the server offline and delete the record.
How to check: The host has an owner on your list, or dig +short [host] gives no answer.
A real case
Researchers found about 8,800 domains and over 13,000 subdomains of brands such as MSN, VMware and McAfee sending about five million spam emails a day in the brands' names, because DNS and SPF records had outlived the services they pointed to.