Your organization may know who owns its domains. But does it know where every subdomain points—and whether the resource behind it still exists? A dangling Domain Name System (DNS) record is a threat vector that’s going to become more common unless companies take action.

What is dangling DNS?

A DNS record can outlive the resource it supports. If it continues to point to an external resource that has been deleted, decommissioned, or is no longer controlled by the organization, it becomes a dangling DNS record and gives third parties the opportunity to take over the abandoned resource.

Some of the reasons this happens are:

• Cloud resources being deleted without removing associated DNS records
• Marketing campaign sites being retired
• SaaS platforms being replaced
• Development and test environments being abandoned
• Mergers and acquisitions leaving legacy infrastructure
• Agencies and third parties creating subdomains
• Different teams managing DNS and cloud infrastructure

If a third party can claim the resource referenced by a dangling record, they may be able to host content under a trusted corporate subdomain. This can lead to potential consequences, such as phishing, credential harvesting, malware distribution, brand impersonation, and reputational damage.

How is AI changing this attack vector?

Today, attackers can combine AI with automated reconnaissance to discover dangling DNS records and prioritize which ones to exploit. AI tools can make it much easier and faster to analyze large numbers of domains and correlate DNS information with cloud services.

With this technology, attackers don’t need to infiltrate your infrastructure, as they can analyze thousands of subdomains and identify vulnerable targets to attack quickly with AI. This can cause damage to the brand holder.

Who’s responsible?

This situation poses a challenge for many companies—with IT, security, and marketing departments all having a role to play. Also, organizations may be reluctant to remove older records for fear of breaking a live system.

IT and security teams should work together to identify and remove these records, while securing the budgets and staffing needed to continuously monitor the issue.

Are there solutions?

Just doing a point-in-time DNS audit no longer solves this problem because organizations constantly update DNS records. For large organizations, these updates can even number in the thousands.

Organizations need continuous monitoring of their subdomains and must understand how their DNS records are resolving. AI is dramatically reducing the time and effort required to discover forgotten digital assets. Organizations need the same continuous visibility on the defensive side to discover, monitor, and secure every subdomain before an attacker finds the one that has been left behind.