DNS records have valid targets with no takeover risk

​

What this check verifies

Cloudflare DNS records (CNAME, MX, NS, SRV) that point to hostnames are assessed for dangling record vulnerabilities by checking if the target domain resolves to a valid address, preventing subdomain takeover, mail interception, and service hijacking attacks.

​

Risk

Dangling DNS records pointing to non-existent targets create multiple vulnerabilities. Dangling CNAME/NS allows subdomain takeover; dangling MX allows mail interception. Attackers can impersonate your organization, hijack services, or redirect legitimate traffic to attacker-controlled infrastructure.

​

Recommendation

Remove or update dangling DNS records to prevent takeover and interception attacks.

• Regularly audit DNS records when decommissioning services
• Remove CNAME, MX, NS, and SRV records pointing to deprovisioned resources
• Monitor for unauthorized changes to DNS records
• Consider using DNS monitoring tools to detect dangling records

​

Remediation

Dashboard steps

1. Log in to the Cloudflare dashboard and select your account and domain
2. Go to DNS > Records
3. Identify CNAME, MX, NS, or SRV records with dangling targets
4. Either update the record to point to a valid target or delete the record
5. If the target service was decommissioned, remove the DNS record

​

References

• https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/

​

Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = dns_record_cname_target_valid. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Cloudflare checks