<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud DNS Security — API Reference

## AWS Route 53 API

```bash
aws route53 list-hosted-zones --output json
aws route53 list-resource-record-sets --hosted-zone-id ZONE_ID
aws route53 get-dnssec --hosted-zone-id ZONE_ID
aws route53resolver create-resolver-query-log-config --name NAME --destination-arn ARN
```

## DNS Security Checks

| Check | Command | Risk |
|-------|---------|------|
| Dangling CNAME | `dig +short TARGET` | Subdomain takeover |
| DNSSEC | `dig +dnssec DOMAIN SOA` | DNS spoofing |
| Zone transfer | `dig AXFR DOMAIN @NS` | Data leakage |
| TXT records | `dig TXT DOMAIN` | Info disclosure |

## GCP Cloud DNS

```bash
gcloud dns managed-zones list
gcloud dns record-sets list --zone=ZONE
gcloud dns managed-zones describe ZONE
gcloud dns policies create NAME --networks=NET --enable-logging
```

## Azure DNS

```bash
az network dns zone list
az network dns record-set list --zone-name ZONE --resource-group RG
az network dns dnssec-config show --zone-name ZONE --resource-group RG
```
