Skip to content

v1.10.3 — Self-referential CNAME classification

Choose a tag to compare

View all tags
@incendiary incendiary released this 10 May 12:05
· 86 commits to main since this release
v1.10.3
16018eb

What changed

Self-referential CNAME fix

A domain with a CNAME pointing to itself was being surfaced as an unclassified takeover candidate with misleading risk text. It is a DNS misconfiguration — the target cannot be claimed by an attacker since it sits under a registered apex. It now appears in the summary under [self_referential]:

  Classified dangling CNAMEs (1)
    [self_referential]
      atomic-uat.example.com.
        Recommendation : Remove or correct the CNAME — the domain points to itself and will never resolve
        Evidence       : N/A

Latent bug fix

The NS query path inside check_dangling_cname_async was still writing to the removed ns_takeover output key (leftover from the v1.10.0 output consolidation). This path would have caused a KeyError at runtime for any domain whose CNAME target had NS records but no address records. Fixed to write NS_TAKEOVER| prefixed lines to the consolidated takeover key.

Assets 2
Loading