Skip to content
RFC 10023 and the _for-sale TXT record: what it means for DNS securitySponsored byWhoisXML API
DNSAudit.io - Domain Security Scanner

Exposed 3rd-Party Services in DNS Records

Third-party integrations and verification records visible in DNS

Warning
Information Disclosure
Attack Surface

Security Warning

Your DNS records expose third-party service integrations that increase your attack surface and provide reconnaissance information to potential attackers.

Why This Check Exists

DNS records tend to stick around.

Every integration, SaaS tool, certificate request, or verification step usually adds something to DNS. When those tools are removed or replaced, the DNS records are often forgotten.

Because DNS is public, those records quietly expose information about your environment to anyone who looks.

What This Check Looks For

This check analyzes TXT and CNAME records and identifies patterns commonly used by third-party services.

These records are typically used for:

  • Domain ownership verification
  • SaaS and platform integrations
  • Marketing and analytics tools
  • Certificate validation
  • Identity and collaboration services

The check does not assume the records are wrong. It surfaces what is exposed so it can be reviewed.

DNSAudit.io scan result for cloudflare.com showing the Exposed 3rd-party services in TXT records finding expanded, with detected services grouped by domain verification, collaboration tools, marketing and remote access
A real scan of cloudflare.com (October 2026): the check groups the third-party services it recognizes in TXT records and lists the recommended cleanup.

Why This Matters

Exposed third-party records reveal:

  • What platforms are or were connected to the domain
  • What services users might recognize and trust
  • What vendors could be abused for impersonation or phishing

This information is useful during reconnaissance and lowers the effort required to build convincing attacks.

How to Fix It

Review all TXT and CNAME records and confirm which ones are still required.

Recommended Actions

  • Remove records tied to services that are no longer used
  • Keep only verifications needed for active integrations
  • If a record contains a token or verification value, rotate it in the upstream service before replacing it
  • Remove stale or duplicate certificate validation records
  • Recheck after DNS propagation

Example: Identifying Stale Records

Query TXT records for your domain:

dig example.com TXT +short

Common patterns to look for:

  • google-site-verification=... (Google Search Console)
  • MS=... (Microsoft 365)
  • facebook-domain-verification=... (Meta)
  • _dmarc, _domainkey (Email authentication - keep these!)
  • docusign=... (DocuSign)
  • atlassian-domain-verification=... (Atlassian)

Query for service-specific CNAMEs:

dig _acme-challenge.example.com CNAME +short
dig em1234.example.com CNAME +short

What to Be Careful With

Not every record should be removed. Some TXT and CNAME records are required for email delivery, certificate renewals, or active service ownership checks. Removing the wrong record can break production systems. If the purpose of a record is unclear, confirm it before deleting.

Run This Check Regularly

DNS changes slowly, but it rarely gets cleaned up. Running this check periodically helps keep DNS focused on what is actually in use and avoids unnecessary exposure over time.

Last updated: December 21, 2025