<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cloud-dns-security
description: >-
  Audit cloud DNS configurations for dangling records, zone transfer
  exposure, DNSSEC misconfiguration, subdomain takeover vulnerabilities,
  and DNS tunneling indicators across AWS Route 53, GCP Cloud DNS,
  and Azure DNS.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - dns-security
  - route53
  - cloud-dns
  - dnssec
  - subdomain-takeover
  - dns-tunneling
  - dangling-records
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1071.004", "T1568"]
---

# Auditing Cloud DNS Security

## Overview

Audit cloud DNS configurations for dangling records, zone transfer exposure, DNSSEC misconfiguration, subdomain takeover vulnerabilities, and DNS tunneling indicators across AWS Route 53, GCP Cloud DNS, and Azure DNS.

Mode: `[MODE: BLUE]` — Audit DNS security. `[MODE: RECON]` — Detect DNS-based threats.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI, gcloud CLI, or az CLI configured | Required |
| DNS zone admin access | Required |
| dig or nslookup for DNS queries | Required |

## Key Concepts

### Detect Dangling DNS Records

```bash
# List Route 53 hosted zones
aws route53 list-hosted-zones --output json | \
  jq '.HostedZones[] | {{id: .Id, name: .Name}}'

# List all records in a zone
aws route53 list-resource-record-sets --hosted-zone-id ZONE_ID --output json

# Find CNAME records pointing to non-existent resources
aws route53 list-resource-record-sets --hosted-zone-id ZONE_ID --output json | \
  jq -r '.ResourceRecordSets[] | select(.Type == "CNAME") |
  .ResourceRecords[].Value' | while read target; do
    dig +short "$target" | grep -q . || echo "DANGLING: $target"
  done
```

### Check DNSSEC Configuration

```bash
# Check Route 53 DNSSEC status
aws route53 get-dnssec --hosted-zone-id ZONE_ID

# Verify DNSSEC with dig
dig +dnssec example.com SOA

# Check DS record propagation
dig DS example.com @ns1.parent.com
```

### Subdomain Takeover Detection

```bash
# Check for CNAMEs pointing to deprovisioned services
# Common targets: S3, CloudFront, Heroku, Azure, GitHub Pages
aws route53 list-resource-record-sets --hosted-zone-id ZONE_ID --output json | \
  jq -r '.ResourceRecordSets[] | select(.Type == "CNAME") |
  select(.ResourceRecords[].Value |
    test("s3.amazonaws|cloudfront|herokuapp|azurewebsites|github.io")) |
  {{name: .Name, target: .ResourceRecords[].Value}}'
```

### DNS Query Logging

```bash
# Enable Route 53 query logging
aws route53resolver create-resolver-query-log-config \
  --name dns-security-log \
  --destination-arn arn:aws:logs:REGION:ACCOUNT:log-group:dns-logs

# GCP DNS query logging
gcloud dns policies create dns-logging \
  --networks=default --enable-logging
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/auditing-cloud-dns-security-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Auditing Cloud Dns Security Detection
id: 07551ae7-9547-4807-b59c-b29daf7a8f99
status: experimental
description: Detects suspicious activity related to auditing cloud dns security techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1071.004
  - attack.t1568
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Cloud Dns Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1071.004, T1568 |

## Verification

- [ ] DNSSEC enabled on all public hosted zones
- [ ] No dangling CNAME records pointing to deprovisioned services
- [ ] DNS query logging enabled for threat detection
- [ ] Zone transfer restricted (AXFR disabled)
- [ ] Regular subdomain takeover scans scheduled
- [ ] DNS tunneling detection alerts configured

## References

- [AWS Route 53 DNSSEC](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-configure-dnssec.html)
- [GCP Cloud DNS Security](https://cloud.google.com/dns/docs/dnssec)
- [Subdomain Takeover — can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz)
- [MITRE ATT&CK T1071.004 — DNS Protocol](https://attack.mitre.org/techniques/T1071/004/)
