DANGLEGEDDONDNS survival system

[ THE END OF YOUR DNS IS OPTIONAL ]

DON’T LEAVE
THE DOOR
DANGLING.

Forgotten services. Abandoned infrastructure. DNS records pointing into the void. Find the weak links before someone else does.

CHECK YOUR PERIMETER ↓
Discover exposure•Cross-check resolvers•Close the loop•Survive the fallout

PERIMETER CONTROL

Initiate a DNS sweep.

READ-ONLY OPERATION
>_
Expand the perimeter — add hostnames
Import a zone file — check every record

⚠ Read before uploading a zone file

A zone file is a complete map of your DNS. It often holds internal and staging hostnames, private IP addresses, mail and VPN infrastructure, and verification tokens. Treat it like a credential.

  • Public resolvers cache what we look up. Every CNAME, MX, NS and SRV target in the file is queried through Cloudflare and Google public DNS. Those resolvers cache the answers and may log the queries, and queried names can end up in passive-DNS datasets that others use to enumerate domains. This cannot be undone.
  • Reports carry the full inventory. JSON exports and shared report links contain every record from the file. Anyone with the link can read it.
  • Only scan what you are authorized to assess. Uploading someone else’s zone, or one you are not permitted to share, may breach policy or law.

Danglegeddon processes the file in memory and does not store it — but the risks above happen outside our control. Remove internal-only records and secrets first. If you are not sure, do not proceed.

Zone import is locked until all three statements are confirmed.

With a zone file, records come from the file and every CNAME, MX, NS and SRV target is checked live. The hostname list above is ignored.

Queries the domain + www by default, or every record in an imported zone. Checks A, AAAA, CNAME, MX, NS, TXT, CAA and SOA through Cloudflare and Google Public DNS.

Public DNS cannot reveal every record. Add your known hostnames for wider coverage. A scan identifies indicators; it does not confirm resource claimability.

KNOW YOUR ENEMY

Your DNS remembers.
Even when you forget.

A dangling record points to infrastructure that no longer exists. If the destination can be reclaimed, someone else may be able to serve content under your domain.

Interrogate the records

Query explicit hostnames across two independent public resolver networks. Keep the evidence visible.

Trace the loose ends

Check whether CNAME, MX and NS destinations resolve. Separate broken dependencies from uncertain results.

Reclaim your perimeter

Remove retired records or restore the intended service. Verify provider ownership before calling a takeover possible.