Dangling NS / Orphaned Nameservers

What This Check Does

This check looks at every nameserver hostname listed in your domain's NS records and verifies that each one actually resolves to an IP address. If a nameserver hostname returns nothing, or cannot be found at all, it is considered orphaned.

An orphaned nameserver is a name that your domain still points to as an authority, but that no longer exists in DNS.

Why This Happens

Orphaned nameservers are almost always the result of incomplete decommissioning. A team migrates to a new DNS provider, updates the NS records to point to the new nameservers, but either forgets to remove the old ones or intentionally keeps them thinking it is harmless. In some cases the old hostname belonged to infrastructure the company no longer controls, such as a nameserver at a previous hosting provider whose account has since been closed.

The NS record stays. The hostname behind it disappears. And the domain keeps advertising it as authoritative.

The Attack

This is one of the most well-documented and actively exploited paths to DNS takeover. DNS resolvers, when looking up your domain, will cycle through the nameservers listed in your NS records. If one of those nameservers does not respond, resolvers move on to the next one. This means the orphaned nameserver can sit there for a long time without anyone noticing, because the domain keeps working through the remaining live nameservers.

What an attacker can do is register the orphaned hostname at any DNS hosting provider that allows you to create arbitrary hostnames. Once registered, they configure it to answer authoritatively for your domain. At that point they control one of the nameservers your domain advertises, and they can answer a portion of DNS queries for your domain with whatever records they choose. Depending on how resolvers distribute queries across nameservers, this can affect a meaningful percentage of your traffic, or in some cases all of it. The attacker can point your domain to their own servers, intercept mail, or serve content of their choosing under your name.

How to Fix It

First, identify which nameservers are orphaned. You can test each one manually:

dig A ns1.yourdomain.com
dig A ns2.yourdomain.com

Any nameserver that returns NXDOMAIN or no address records should be removed from your NS record set immediately. Do not wait to confirm whether it is still needed. If it does not resolve, it is a liability.

If the nameserver belonged to a provider you no longer use, also verify whether that hostname is still registered. If it is not, the registration window is open.

After removing orphaned entries, make sure you have at least two live, functioning nameservers remaining in your NS records. Running with a single nameserver after cleanup is its own availability risk.

As a general practice, when decommissioning DNS infrastructure, always remove the NS records first, before decommissioning the servers themselves.