doors/no-dangling-dns

No CNAME points at a name that no longer resolves, the usual start of a subdomain takeover.

highofficial

Install

firedrill hub add doors/no-dangling-dns

Reads

config.domains, dns.cnames

Fix when it fails

Delete the CNAME, or reclaim the target it points to.

Test cases

Case	Expected
resolves	PASS
dangling	FAIL
nothing	N/A

Drill file

firedrill: v0
id: doors/no-dangling-dns
safeguard: "No CNAME points at a name that no longer resolves, the usual start of a subdomain takeover."
severity: high
for_each: config.domains
fetch:
  cnames: { fact: dns.cnames, args: { domain: target.domain } }
pass_when:
  - cnames.found.filter(c, !c.target_resolves).size() == 0
fix: "Delete the CNAME, or reclaim the target it points to."