Configuration: Dangling CNAME record¶

Identifier: dangling_cname

Scanner Support¶

Description¶

Dangling CNAME records point to a target that no longer exists, leaving stale DNS configuration behind.

How we test: We resolve the target of each CNAME record. If it doesn't exist, we check whether its registrable domain is available for registration. When it's already registered (for example a cloud provider hostname), the record can't be taken over and is reported as a dangling record to clean up.

This is a hygiene issue: the record serves nothing and should be removed to keep DNS accurate and to avoid future takeover if the target ever becomes claimable.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  dangling_cname:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.