Monitoring & Risk

ASM: DNS & Risk: find dangling DNS records

A "dangling" record is a CNAME (or similar) that still points at a cloud service, marketing tool or hosting account you cancelled. Anyone who signs up for that service can claim the name and suddenly they are you. It never shows up in DMARC reports.

Where to find it

Monitoring & Risk → ASM: DNS & Risk

What you'll see

• How many records are monitored and how many are currently dangling.
• DNSSEC and DANE status per record (two standards that protect DNS answers themselves from tampering).
• For each dangling record, the exact CNAME target it points at, so you know precisely what to remove or reclaim.

Fixing one

1. Decide: remove or reclaim

   If nobody uses the service any more, delete the record at your DNS provider. If you still need it, log back into the service and re-claim the hostname so the record points at something you own.

2. Re-scan

   Once the record is gone or reclaimed, the entry drops off the list on the next check.

For records specifically involved in sending mail (dangling MX, broken SPF includes), see SubdoMailing Guard.