dns-domain-securitylisted

# DNS & Domain Security Everything above DNS assumes DNS is telling the truth. TLS certificates are issued based on DNS-validated control, email authentication lives in TXT records, and your entire brand hangs off a registrar login. Yet the DNS layer usually gets one setup session at launch and then years of unreviewed drift: records pointing at services that no longer exist, a registrar account with a password from 2019, and API tokens with zone-wide write access baked into three CI pipelines. This skill audits and hardens that layer. The recurring theme is **lifecycle**: DNS records outlive the things they point to, and every orphaned pointer is a liability someone else can pick up. ## When to invoke - Periodic audit of a zone you operate (quarterly is a good cadence) - A SaaS service, PaaS app, or static-hosting project was decommissioned — did its DNS records go with it? - Domain or registrar account is changing hands (team member left, agency handover, acquisition) - A certificate appeared in CT logs that nobody requested - Setting up DNS automation (CI, ACME DNS-01, dynamic records) and deciding token scope - A domain in the portfolio is approaching expiry ## The threat map | Layer | Attack | Primary control | |---|---|---| | Registrar account | Credential stuffing, social-engineered transfer | MFA (hardware key), transfer lock, registry lock | | Domain lifecycle | Expiry → re-registration by attacker | Auto-renew, expiry monitoring, long registration | | Zone con