Forgotten DNS Records Could Become a Nation-State Weapon, Researchers Warn
A technique called 'dangling DNS' has lurked in security circles for years. Researchers now say AI could automate it at a scale that threatens governments and the software supply chains millions of organisations depend on.
Key points
- Researchers warn that AI could mass-automate 'dangling DNS' attacks, turning a niche technique into a threat operating at global scale.
- A dangling DNS record is an old address label that still points to a server the original owner no longer controls.
- Potential targets include government portals, financial institutions and software update infrastructure.
- No specific incident has occurred; this is a forward-looking warning first reported by SecurityWeek.
- Regular auditing and deletion of stale DNS records is the primary defence.
What is a dangling DNS record, and why does it matter?
Every website has an address record, a small line of text that tells your browser where to find it. When a company retires an old server but forgets to delete that record, it 'dangles', pointing at nothing the company still owns.
An attacker who spots the gap can register that now-vacant address. Anyone whose browser follows the old record ends up on the attacker's machine, with no visible warning in the address bar.
The attack isn't new. What researchers are now flagging, as first reported by SecurityWeek, is that AI tools could scan the entire public internet for these gaps automatically, finding thousands of vulnerable records in the time it once took a skilled researcher to find one. Our 29 May piece on DNS as infrastructure for AI agents shows how much new traffic is now being routed through DNS, which only widens the target surface.
How bad could this actually get?
Bad, if the warnings hold up.
A government agency's forgotten subdomain could be silently hijacked. Visitors logging into what looks like an official portal hand their credentials to the attacker. The same logic applies to a bank's retired endpoint or a software vendor's update server.
Supply-chain attacks are the sharpest concern. If a software company's update mechanism points to a dangling record, whoever claims that address could push malicious builds to every customer automatically. MFA, where a second proof of identity is required beyond a password, won't help: the user is talking to the wrong server before any login prompt appears.
Researchers have coined 'DangleGeddon' for an AI-accelerated version of this threat at genuinely global scale.
What should organisations do right now?
Delete stale records. That's the short answer.
| Action | Why it helps |
|---|---|
| Audit all DNS records quarterly | Finds forgotten entries before attackers do |
| Remove records when decommissioning a server | Closes the window immediately |
| Use DNS monitoring alerts | Flags unexpected changes in near-real time |
| Track cloud and hosting assets centrally | Prevents orphaned resources going unnoticed |
For ordinary users, the threat is subtle. A hijacked subdomain can look entirely legitimate. If a familiar site asks you to log in again unexpectedly or looks slightly off, contact the organisation through a phone number you already have on file.
The underlying problem isn't a software bug with a patch; it's a housekeeping failure. No CVE will fix it. Treat DNS records the way a pharmacy treats expired stock: check regularly, dispose cleanly.
