Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We scanned DNS TXT records for the Fortune 500 and here's what they exposed

dnsaudit.io

Post reply on HN
Print view View original

1–4 of 4 posts

Re: We scanned DNS TXT records for the Fortune 500 and here's what they exposed

#2

Post by shakauy »

DNS TXT records are usually added for email auth or vendor verification and rarely revisited. We scanned TXT records across Fortune 500 domains to see what they expose at scale, and found they consistently reveal email infrastructure, SaaS dependencies, legacy tooling, and long-lived operational artifacts. The analysis shows how much actionable security and intelligence context is visible through public DNS alone, without touching a single endpoint.

Re: We scanned DNS TXT records for the Fortune 500 and here's what they exposed

#3

Post by Bender »

shakauy wrote: post #2

DNS TXT records are usually added for email auth or vendor verification and rarely revisited. We scanned TXT records across Fortune 500 domains to see what they expose at scale, and found they consistently reveal email infrastructure, SaaS dependencies, legacy tooling, and long-lived operational artifacts. The analysis shows how much actionable security and intelligence context is visible through public DNS alone, wi…

I would also add that these dangling TXT records also build up into a amplification DDoS risk for recursive name servers. When running public recursive servers I have had to strip the TXT records for several domains including but not limited to 500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com. Take a look:

    for i in $(echo "500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com");do dig +short +nocookie -t TXT "${i}";echo;done
To strip them in Unbound I used:

    local-zone: ebay.com typetransparent
    local-data: 'ebay.com. TXT "[ddos redacted]"'
My public name servers served a specific purpose for people and domains in a certain country being filtered so stripping such records were perfectly splendid as I was expecting a country to attack me.

Re: We scanned DNS TXT records for the Fortune 500 and here's what they exposed

#4

Post by shakauy »

Bender wrote: post #3
shakauy wrote: post #2

DNS TXT records are usually added for email auth or vendor verification and rarely revisited. We scanned TXT records across Fortune 500 domains to see what they expose at scale, and found they consistently reveal email infrastructure, SaaS dependencies, legacy tooling, and long-lived operational artifacts. The analysis shows how much actionable security and intelligence context is visible through public DNS alone, wi…

I would also add that these dangling TXT records also build up into a amplification DDoS risk for recursive name servers. When running public recursive servers I have had to strip the TXT records for several domains including but not limited to 500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com. Take a look: for i in $(echo "500px.com box.com ebay.com google.com hm.com…

Indeed! Good point, TXT records pile up fast with SPF, DKIM, DMARC, and vendor checks, which increases amplification risk for resolvers, and it's the same sprawl we’re seeing as long-lived infrastructure signals from the outside!
Post reply on HN