Every dangling record was created correctly and then outlived the thing it pointed at. The fix is not detection — detection finds them after the window opens. It is an order of operations at decommission time.
The order
WRONG RIGHT 1. cancel the SaaS account 1. remove the DNS record 2. ... 2. wait out the TTL 3. remove the DNS record 3. confirm nothing still resolves (weeks later, or never) 4. cancel the SaaS account Between steps 1 and 3 on the left, the name is claimable and the record still points at it.
DNS first, always. The window on the left is however long it takes somebody to remember, which in practice is measured in years. The window on the right is zero.
The decommission checklist
| Step | Detail |
|---|---|
| 1. Find every record pointing at the service | Not just the obvious CNAME. Verification TXT records, MX, a delegated NS, records on other domains in the estate. |
| 2. Remove them all | Before anything is cancelled. |
| 3. Wait out the longest TTL | Resolvers still holding the old answer will keep using it. |
| 4. Confirm | Query each name from a public resolver. NXDOMAIN, not a stale answer. |
| 5. Then cancel the account | Now the name being released matters to nobody. |
| 6. Record it | So the next audit knows this was deliberate rather than forgotten. |
Why this is an organisational problem
- The person cancelling the account is not the person who owns DNS. Usually a different team, often a different budget, occasionally a different company.
- Cancellation is driven by cost, not by architecture. A finance review that stops a subscription has no reason to involve anyone who knows a DNS record exists.
- Nothing breaks visibly. The name stops working, which is what was intended, and nobody looks again.
- So the control is a checklist item on offboarding a vendor, next to revoking the DKIM selector and removing the SPF include. All three are the same discipline and all three are missed together.
Audit as though you are the attacker
Quarterly, take every name in the zone and resolve every target. A CNAME to a host that does not exist, an NS that does not answer, an MX that does not resolve — all three are findable in minutes with a script, and the same script an attacker runs against you. The only advantage you have is that you can enumerate the zone without walking it.