Uncommon DNS Records
Specialized DNS records that may expose sensitive information
Security Warning
Your domain contains uncommon DNS record types that may inadvertently expose sensitive information about your infrastructure, geographic location, certificates, or internal systems to potential attackers.
Understanding Uncommon DNS Records
Beyond standard DNS records like A, AAAA, MX, and TXT, there are dozens of specialized DNS record types designed for specific purposes. While these records can provide valuable functionality, they often contain detailed information about your infrastructure that attackers can use for reconnaissance and attack planning.
Security Risk: Uncommon DNS records can expose sensitive infrastructure details including server locations, SSH fingerprints, and network topology to potential attackers during reconnaissance.
Information Disclosure Concerns
Records like LOC (location) can reveal physical server locations, SSHFP records expose SSH key fingerprints, CERT records contain cryptographic certificates, and various service records (SRV, NAPTR) can map your internal network topology. This information helps attackers understand your infrastructure and identify potential attack vectors.
Information Disclosure Risk
The primary concern with uncommon DNS records is information disclosure. These records can reveal technical details about your systems, network architecture, security implementations, and operational practices that were never intended for public consumption.
With information disclosure risks identified, implementing proper DNS record management becomes critical for reducing reconnaissance opportunities. The following systematic approach ensures appropriate handling of sensitive DNS data.
Record Discovery and Assessment
Identify and evaluate uncommon DNS records in your domain
Comprehensive DNS Enumeration
Scan for all DNS record types in your domain:
Location and Geographic Records
Check for location records that might expose physical server locations and geographic coordinates.
# Query for location records
dig yourdomain.com LOC # Location recordsRisk: LOC records contain precise latitude, longitude, and altitude data that can reveal exact physical locations of your servers.
Security and Certificate Records
Scan for security-related records that might expose cryptographic information and authentication details.
# Query for security records
dig yourdomain.com SSHFP # SSH fingerprint records
dig yourdomain.com CERT # Certificate records
dig yourdomain.com TLSA # TLS association records
dig yourdomain.com OPENPGPKEY # OpenPGP key recordsExposure risk: These records contain SSH fingerprints, certificates, and encryption keys that attackers can use to identify specific server configurations.
Service Discovery Records
Look for service-related records that might reveal network topology and internal service architecture.
# Query for service records
dig yourdomain.com NAPTR # Naming authority pointer
dig yourdomain.com URI # URI recordsArchitecture disclosure: NAPTR and URI records can map your internal network topology and reveal service endpoints not meant for public discovery.
Document all discovered records and their contents for security review.
High-Risk Record Types
Common uncommon records that expose sensitive information:
- • LOC: Geographic coordinates and altitude of servers
- • SSHFP: SSH server key fingerprints for verification
- • CERT: X.509 certificates and PGP keys
- • HINFO: Hardware and operating system information
- • RP: Responsible person contact information
- • TLSA: TLS certificate association data
Automated Scanning Tools
Use specialized tools for comprehensive DNS record discovery:
DNSRecon - Comprehensive Record Discovery
DNSRecon performs thorough DNS enumeration including standard and uncommon record types with detailed reporting.
# DNSRecon for comprehensive scanning
dnsrecon -d yourdomain.com -t stdCoverage: Scans for A, AAAA, NS, MX, SOA, TXT records plus uncommon types like LOC, HINFO, and RP records.
Fierce - Recursive Subdomain Discovery
Fierce specializes in finding subdomains and their associated DNS records through brute force and recursive discovery.
# Fierce for recursive subdomain/record discovery
fierce -dns yourdomain.comDeep discovery: Identifies hidden subdomains and their DNS records that might contain sensitive information not found in the main domain.
DNSEnum - Extensive Enumeration
DNSEnum provides the most comprehensive DNS enumeration including zone transfers, brute forcing, and reverse lookups.
# DNSEnum for extensive enumeration
dnsenum yourdomain.comComplete analysis: Performs zone transfers, Google scraping, brute force attacks, and reverse lookups to find all possible DNS information.
Information Security Controls
Secure or remove unnecessary information disclosure
Remove Unnecessary Records
Delete DNS records that expose sensitive information without providing value:
Remove Location Records
Location records reveal precise geographic coordinates and should be removed unless essential for services.
# Remove location records if not needed
# DELETE: yourdomain.com LOC 40.748817 -73.985428 10mPrivacy protection: This eliminates GPS coordinates that could be used to identify physical server locations or data centers.
Remove Hardware Information
Hardware information records provide detailed system specifications that assist attackers in targeting specific vulnerabilities.
# Remove hardware information records
# DELETE: yourdomain.com HINFO "PC-Intel-700mhz" "Linux"Operational security: Removes CPU, memory, and OS details that help attackers identify platform-specific exploits.
Remove Contact Information
Outdated responsible person records may expose internal contact details and organizational structure.
# Remove outdated responsible person records
# DELETE: yourdomain.com RP admin.yourdomain.com yourdomain.comContact protection: Prevents exposure of administrative contacts that could be targets for social engineering attacks.
Focus on removing records that provide reconnaissance value without operational necessity.
Sanitize Remaining Records
For necessary records, minimize information exposure:
- • Use generic or obfuscated values where possible
- • Remove version numbers and detailed system specifications
- • Replace specific contact information with generic addresses
- • Use internal references instead of exposing external details
Access Control Implementation
Restrict access to sensitive DNS information:
Internal Network View Configuration
Configure a DNS view for internal network clients that provides detailed information needed for internal operations.
# DNS view configuration (BIND) - Internal view
view "internal" {
match-clients { 192.168.0.0/16; 10.0.0.0/8; }; // Private network clients only
zone "yourdomain.com" {
type master; // Authoritative master zone
file "/etc/bind/internal/yourdomain.com"; // Internal zone file with detailed records
allow-query { 192.168.0.0/16; 10.0.0.0/8; }; // Restrict queries to internal networks
allow-transfer { none; }; // Block zone transfers
# Contains: detailed HINFO, LOC, internal services, private IPs
};
};Internal access: Provides complete DNS information to internal network clients while blocking external access to sensitive records.
External Public View Configuration
Configure a restricted DNS view for external clients that only exposes essential public information.
view "external" {
match-clients { any; }; // All other clients (Internet)
zone "yourdomain.com" {
type master; // Authoritative master zone
file "/etc/bind/external/yourdomain.com"; // External zone file with minimal records
allow-query { any; }; // Allow public queries
allow-transfer { none; }; // Block zone transfers for security
# Contains: only essential A, AAAA, MX, TXT records (no detailed info)
};
};Public protection: Limits external visibility to only essential DNS records needed for public services, hiding internal infrastructure details.
Security Benefit: This split-horizon configuration provides internal users with detailed information while limiting external exposure to essential records only.
Ongoing Protection
Maintain security for DNS record management
DNS Record Auditing
Establish regular review processes for DNS records:
- • Monthly reviews of all DNS records for unnecessary information exposure
- • Automated scanning to detect new uncommon record types
- • Documentation requirements for all non-standard DNS records
- • Approval processes for adding specialized DNS record types
Security Monitoring
Monitor for DNS reconnaissance activities:
- • Log DNS queries for uncommon record types
- • Set up alerts for enumeration attempts against your domain
- • Monitor for suspicious patterns in DNS query logs
- • Track external tools scanning your DNS infrastructure
Best Practices
- • Principle of least disclosure: only publish necessary DNS information
- • Regular security assessments including DNS record review
- • Staff training on information disclosure risks in DNS
- • Incident response procedures for DNS-based reconnaissance detection
- • Integration of DNS security into overall security monitoring programs
Last updated: January 8, 2026