There is a microsite
for a campaign that ran in 2023.
Nobody has opened it in two years.
The team who built it
has been reorganised twice,
and the hosting account
was closed when the budget was.
The name still points there.
That is the part
that did not get cleaned up,
and it is the part that matters.
A DNS record is not your property.
It is a sentence about
somebody else's machine.
You deleted your side of it.
You did not delete the sentence.
The platform it points at
hands that hostname
to whoever asks for it next,
because from where that platform stands
the name is unclaimed
and the queue is open.
So a stranger signs up,
types your hostname into a box,
and serves whatever they like
from a domain
that passes every check
a careful person knows how to make.
Real certificate.
Real company name.
No typo to spot,
because there is no typo.
Consider who believes it.
Your customers, obviously.
But mostly your own staff,
who are trained to distrust
odd-looking links
and have never been asked
to distrust a correct one.
And consider what else
is scoped by name.
Cookies you set on the parent domain
are now readable by a site
you do not run.
Callback lists that end
with your domain
now accept a destination
that is not you.
Trust that you granted to a name
transfers with the name.
So take an inventory.
Every DNS record has an owner
and a date and a reason,
or it does not exist.
Look for records pointing
at nothing in particular.
The dangling ones, aimed at platforms
where the resource behind them is gone,
are the whole vulnerability,
and finding them is a script,
not a project.
Delete the record
before you delete the thing.
That order, always.
Scope cookies to the exact host
that needs them,
not to everything underneath you.
Your perimeter is not the machines
you are running.
It is the names you answer to,
including the ones
you stopped thinking about.
– Serguey Asael Shinder
Top comments (0)