Dangling DNS Records Can Outlive the Services They Point To

Mon, 14 Sep 2026 00:00:00 +0700

A hostname can remain part of an organisation’s public identity long after the application behind it has disappeared. The DNS record still resolves, certificates may have existed for years, links remain in old messages, and browser cookies may still be scoped broadly enough to include the name. Yet the external service named by that record may have been deleted and returned to a provider’s pool of available resources.

That mismatch creates the conditions for subdomain takeover. The core problem is not DNS compromise. The authoritative zone can be operating exactly as configured. The failure sits between two control planes: DNS still delegates traffic toward an external platform, while the platform no longer associates the referenced resource with the domain owner.

DNS Rebinding Turns Browser Reachability Into a Security Boundary

Sun, 13 Sep 2026 00:00:00 +0700

A service bound to a private address often feels insulated from the public web. An administrative panel on a home router, a development daemon on a laptop, or an internal HTTP endpoint may have no public route at all. Yet a browser on the same network can often reach it, and that browser also processes content from arbitrary public sites.

DNS rebinding exploits the seam between those facts. A hostile site can use a domain it controls, arrange for that name to resolve to different addresses over time, and attempt to make browser requests under one web origin reach a service that was never intended to receive traffic from public content.

DNS Security on Nalar

Dangling DNS Records Can Outlive the Services They Point To

DNS Rebinding Turns Browser Reachability Into a Security Boundary