DNS Security: Misconfigurations That Put Your Domain at Risk
DNS decides where your users, emails and API clients end up. If an attacker can control or abuse your DNS, they can impersonate your services, intercept traffic or take over subdomains. Many DNS weaknesses are simple configuration issues.
Dangling records
Records pointing to resources that no longer exist, such as a deleted cloud storage bucket, a cancelled SaaS tool or a released IP address, allow subdomain takeover.
Fix: remove DNS records before decommissioning resources, and audit records regularly.
Zone transfers allowed
A misconfigured authoritative DNS server may allow anyone to perform a zone transfer (AXFR), listing every record in your zone at once, including internal hostnames.
Fix: restrict zone transfers to your secondary DNS servers only. Managed DNS providers generally handle this.
Registrar account compromise
Control of your domain registrar account means control of everything. Attackers who take it over can change nameservers and redirect all traffic and email.
Fix:
- Enable MFA on registrar and DNS provider accounts.
- Use a role-based email address for the account, with restricted access.
- Enable registrar lock and, for critical domains, registry lock where available.
- Keep domains renewed automatically, with alerts.
Expired domains
Letting a domain expire, even an old one, allows anyone to register it. If it is still referenced in code, email, documentation or OAuth configuration, the new owner may receive traffic, emails or tokens.
Fix: track all domains, renew those still referenced anywhere, and remove references before letting any domain lapse.
Missing CAA records
Certification Authority Authorization (CAA) records specify which certificate authorities may issue certificates for your domain.
Fix: add CAA records listing the CAs you use, reducing the risk of mis-issued certificates.
example.com. CAA 0 issue "letsencrypt.org"Email-related DNS
SPF, DKIM and DMARC records live in DNS and control email spoofing protection. See our email security guide.
DNSSEC
DNSSEC adds cryptographic signatures to DNS responses, protecting against spoofing and cache poisoning. It requires careful key management; misconfiguration can make your domain unreachable. Many managed DNS providers make it easier to enable.
Internal names in public DNS
Public records for internal systems, such as vpn, jenkins-internal or db-primary, give attackers a map of your infrastructure.
Fix: use private DNS zones for internal names.
Wildcard records
Wildcard DNS records can make every possible subdomain resolve, which can hide takeover issues, complicate monitoring and sometimes assist phishing. Use them deliberately.
DNS security checklist
| Check | Status |
|---|---|
| MFA on registrar and DNS provider | |
| Registrar lock enabled | |
| Auto-renew for all domains | |
| No dangling records | |
| Zone transfers restricted | |
| CAA records present | |
| SPF, DKIM, DMARC configured | |
| Internal names in private zones |
Monitoring your DNS
SecurityInfinity enumerates your subdomains, resolves their targets and flags dangling records, exposed internal names and services that should not be public. Start free.
Frequently asked questions
Is DNSSEC necessary?
It adds protection against spoofing but requires careful management. It is increasingly recommended, especially for high-value domains.
How do attackers find all my subdomains?
Through certificate transparency logs, passive DNS datasets, brute forcing and occasionally misconfigured zone transfers.
What is registry lock?
An extra protection offered for some top-level domains, requiring manual verification before critical changes like nameserver updates.