dns.dangling_records Reviewed July 2026

Quick fix

Identify the business owner and intended service behind every reported record.

What this finding means

SecuTest follows bounded CNAME and address relationships and reports records whose external target is unresolved, retired, or otherwise consistent with an abandoned dependency. A dangling record is a configuration defect; takeover risk requires additional provider-specific evidence.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact A DNS record that points to an unclaimed external resource may allow another party to control content under your domain.

Step-by-step fix

Where to make the change

  • The authoritative DNS provider and, for DNSSEC delegation, the domain registrar.
  • The cloud, CDN, SaaS, or hosting tenant referenced by the affected DNS record.

Remediation procedure

  1. Identify the business owner and intended service behind every reported record.
  2. Remove obsolete DNS records immediately when the service is no longer required.
  3. If the service is still required, recreate or claim the referenced resource in the correct provider account.
  4. Review certificate issuance, CDN, SaaS, and cloud logs for unexpected use of the hostname.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Trace authoritative DNS
dig +trace example.com

Inspect common records
dig +short A example.com
dig +short AAAA example.com
dig +short CNAME host.example.com

Verify the fix

  1. Run: dig +trace affected.example.com
  2. Resolve the complete CNAME chain from at least two external resolvers.
  3. Confirm the target exists in the authorized provider account.
  4. Repeat the SecuTest scan after DNS propagation.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Assuming NXDOMAIN alone proves exploitability.
  • Deleting a record before confirming production dependencies.
  • Recreating the resource in the wrong region or tenant.

Authoritative references