Show the name their domain points at

A customer attached a hostname to the product. Tonight, three proofs, in a console you administer. Name the hostname and the record that currently points it: the type, the target, and whether your product still serves that name. Show a name whose target you have released is not still treated as theirs, or write that you cannot see the record. Then show a different customer's name still pointing at a target you still hold, and still resolving to them. If the record, the release, or the other name requires the person who built the product, you have not proved the attachment. You have hoped the DNS you do not hold still means what the screen says.

This is one hostname and the record that points it. It is not the list of hosts your build calls on the way out. Name every host the build calls is that outbound inventory. A name a customer pointed at you is the opposite direction. It is not the companies who already received a row. Name who received their row is that list. A DNS target is not a recipient. It is not the text they were shown when they agreed to a purpose. Show the consent they gave is that text, the act, and the time. Attaching a hostname does not prove the agreement, and showing the agreement does not prove the record still points where you think. It is not a sign-in. Show the login they did not make names an authentication event on an account. A CNAME is not a login.

None of what follows decides whether a statute covers your business, and none of it is legal advice. The measurements below are two public studies of names that still point after the thing they pointed at was released. They do not tell you which law binds a Virginia company with a customer in another country. They do not replace the lawyer you call when a name you used to serve is already answering for someone else. They do tell you the shape of a proof a founder can perform this week, which is a product question. They are not a count of your customers' names.

A record can outlive the machine it names. Daiping Liu, Shuai Hao, and Haining Wang, at CCS 2016, call that a dangling DNS record: the resources the record points at are invalid, and the record has not been purged. They name four security-sensitive types, Dare-A, Dare-CN, Dare-MX, and Dare-NS, and three ways those become useful to someone else: an address in a cloud that can be obtained again, a third-party service that was abandoned, and a domain the record points at that has expired. The abstract's cut is 467 exploitable records in 277 Alexa top 10,000 domains and 52 edu zones (Liu, Hao, and Wang, All Your DNS Records Point to Us). 467 is a count of records. 277 and 52 are counts of zones. A record is not a zone. Do not replace 467 with 277.

The table of distinct apex domains in their subdomain sets prints three cells and a total: 277 in the Alexa top 10,000, 52 in edu, 6 in gov, total 335. The dagger on 277 is overlap across record types inside a zone, a domain that has both an address record and a CNAME, not a license to add the three cells a second time. The abstract's sentence names 277 and 52 and does not name the 6. 6 is not 52. 335 is the table's total of those apexes. It is not 467. The measurement's other total, across all four datasets, is 791 confirmed records and 5,982 potential ones. 791 is not 467. 5,982 is not 791. Potential is the set they did not confirm by obtaining the address. Confirmed is not potential.

The four datasets are not one list. D is unexpired apex domains in the Alexa top 1 million, a snapshot each year from 2010 through 2016. St is subdomains of the top 10,000. Se is subdomains of the top 2,700 edu domains. Sg is subdomains of the top 1,700 gov domains. Zone transfer succeeded for 320 domains. The word list they then scanned with has 20,000 names. 320 is not 20,000. 2,700 is not 1,700. Alexa top 1 million apexes are not the subdomain scan, which they say they constrained because scanning every subdomain of a million names was impractical. A figure from D is not a figure from St.

Two sentences in that paper both use ninety percent, and they are not the same sentence. For apex domains, more than 90% delegate their authoritative DNS to a third party. Separately, the exploitable window they estimated, from three months to seven years, has over 90% of those records vulnerable for more than one year. Delegation is not a duration. Three months is not seven years, and neither is a share. Only four Dare-NS instances appear, all of them in dataset D. 4 is not 467, and an NS record that can take the whole zone is not an A record that points at one address. They re-registered the eight expired examples printed in the paper. After about three months, one owner warned them. 8 is not 1. About 46% of the expired domains look similar to the name that points at them, which is the share a similarity block could have caught. About 54% do not look like the name they endanger. 46 is not 54. Their collectors waited five seconds between EC2 calls and at least ten seconds on Azure, about 7,900 allocation requests a day to EC2 and about 4,300 to Azure. 7,900 is not 4,300. Five seconds is not ten. Those rates are how the researchers collected addresses in 2016. They are not a setting in your console, and they are not a count of your customers.

A later measurement is a different object, on a different list, in a different year. Mingming Zhang, Xiang Li, Baojun Liu, Jianyu Lu, Yiming Zhang, Jianjun Chen, Haixin Duan, Shuang Hao, and Xiaofeng Zheng study hosting-based dangling domains, the case where a customer connected a custom name to a public platform and the platform's endpoint was released while the customer's DNS still pointed at it. They describe the ordinary sequence. The customer asks to add a name. The platform asks them to prove they hold it, a challenge token in a TXT or CNAME, or a file on the site. The platform then allocates an endpoint, a name server, an address, or a name under the platform's own domain. The customer points their record at that endpoint. The person who completes that point is treated as the owner. Combining the proof and the point into one step, or skipping the proof, is the flaw they go looking for. That sequence is the shape of the product question. It is not a finding that your platform is one of the ones they found (Zhang et al., Detecting and Measuring Security Risks of Hosting-Based Dangling Domains).

Read their totals as printed, because the introduction and the table use the same integers against different denominators. The introduction says 114,063 (1.0%) of all tested domains had been hosted on vulnerable services, and 10,351 were hosting-based dangling domains. The table's total row is 1,008,734 apexes, 11,446,359 subdomains, 284,006 (2.5%) ever hosted on a public service, 114,063 (40.2%) of those on a vulnerable service, 10,351 (9.1%) of those dangling, across 2,096 apexes. The footnote says each percent is the fraction of that cell against the cell to its left. So 2.5 is hosted against all subdomains, 40.2 is vulnerable-hosted against hosted, and 9.1 is dangling against vulnerable-hosted. The introduction's 1.0 is 114,063 against all tested subdomains. 1.0 is not 40.2. 9.1 is not 2.5. 10,351 is not 114,063, and neither is 284,006. 2,096 apexes is not 10,351 names. Do not add 1,000,000, 9,808 edu, and 7,198 gov and replace 1,008,734. The total is the total they printed after the lists were combined.

The same paper says the comparison to earlier work three ways: 8×, 8 times, and over eight times. Those phrases are theirs. They are not 10,351 divided by the 2016 paper's 467, and they are not 791. A different decade, a different list (Tranco, not Alexa), and a definition limited to hosting endpoints, is not a ratio you compute to decorate a slide. 101 rounds, from 16 December 2021 to 28 July 2022, is the measurement. 270 new dangling names a week, on average, is a separate sentence. Do not multiply 270 by the months and replace 10,351.

The duration sentences do not all have the same base. They classify the dangling names into four types. Type 1, 77.0%, has both a start and an end inside the study. Type 2, 22.8%, has only an end. Type 3, 0.2%, was already dangling at the first scan and ended during the study. Type 4, still dangling at the end with no start inside the window, has no members. Those three shares are a partition of the detected names. The duration figures they then discuss are of type 1, because that is the set whose whole threat they recorded. 17.0% of that set disappeared within one day. Nearly 60% stayed vulnerable at least five days. 36.3% lasted longer than a month. The introduction says 60% remain vulnerable for over five days, and 36.3% for over a month, without the word nearly and without naming type 1. 60 is not 17.0, and the introduction's 60 is not a license to drop nearly or to apply it to type 2. Five days is not a month. None of these is the 2016 window of three months to seven years, and none of them is that paper's over 90%.

Traffic is a third cut. The body says 45.5% of all the dangling names still received queries, from over 70 million client addresses. The introduction says 70 million, without over. Over 70 million is not 70 million with the word removed, and neither number is a count of names. 43 of the names affect millions or tens of millions of clients. 364 were accessed at least a million times. 43 is not 364. 45.5 is not 43. A name that still receives queries is not a name you have proved you still serve.

The vendor counts are a different table from the name counts. They say the vulnerable services they found cover 52 public vendors. A contributions line says 65 vulnerable services, including 34 new ones. 34 is included in 65. It is not a second total you add. A later count, of services vulnerable because the connecting method itself can be reused, is 105. 105 is not 65, and 65 is not 52. Of nine connecting methods, 7 are vulnerable. 7 is not 9. They name 4 flawed ways a domain-ownership check can be bypassed, affecting the top 20 vendors. 4 is not 7. All of those top 20 were exploitable in their test, able to affect 2,927 custom domains. 12 of the 20 were newly reported by them. 3 had been reported as secure before, and were not. 12 is not 3, and neither is 34. 2,927 is not 10,351. They received confirmation from ten vendors, and they name Amazon, Tencent, and Huawei among them. Ten confirmations is not 20 vendors, and it is not a finding about a vendor they did not name. A cited 1.7 million domains on hosting platforms is someone else's statistic, reference 17 in their paper. It is not 11,446,359.

The table's critical-suffix rows are not the total. Under .edu the dangling cell is 23. Under .gov it is 5 (0.9%). A later sentence says 23 under .edu and 10 under .gov as a country-code suffix. 23 matches the .edu cell. 10 does not match the 5. The parenthetical is the reason: a country-code cut is not the .gov row. 5 is not 10. Of the dangling names, 50.9% are under .com and 35.3% under .net, which are the 5,270 and 3,658 cells. 50.9 is not 35.3. Adding them does not produce 100, and it does not produce 10,351. The .com row's 5.5% is dangling against that row's vulnerable-hosted count, not against all names.

Do the three proofs on one real hostname, in the system that actually answers it. First, the record. Open the name the customer attached. Write the type and the target, and write whether your product still has that attachment. A screenshot of a settings field, with no DNS answer beside it, is a form. The answer from DNS is the proof. If a vendor holds the zone and will not show you the record, write that, and do not tell the customer the name is theirs. Second, the release. Take a name you used to serve and no longer do, or a target you have given back, and show the product does not still route it to that customer. If the record still points at a target you no longer control, the attachment is not over because you deleted a row in your database. Third, the other customer. A different name, still attached, still points at a target you hold, and still resolves to that customer. If you deleted every name to make the first one safe, you have not shown that one release was the thing you did. You have taken the product off the internet.

Three moves feel like the proof and are a second problem. Deleting the customer's account, because deletion is a button you already have, while their DNS still points at an endpoint you released. Replacing every custom name with a name you own, because you cannot see one record, and then describing the outage as hygiene. Asking a model whether the domain is verified, which edits a prompt and leaves the zone. The first answers a deletion they did not send. The second punishes the customers who did not write. The third is a fiction. A host your build calls is name every host the build calls. A login that was not theirs is show the login they did not make. Neither edits this record.

The path is ordinary when an admin can see one tenant's attached name without opening the next tenant's zone as the way to prove it. Gigbase is a multi-tenant workspace with subscription plans, role-based access for agencies, admins, and team members, and a dedicated admin dashboard. The shape that matters here is an admin, in an account you administer, who can open one tenant. That case is not a DNS ledger. Nothing in the description is a headcount, a duration, or a result figure. If the only control on the admin screen deletes the tenant, you do not have this proof. You have a kill switch.

There is a version of this hostname where hiring the path is the wrong purchase. Nobody has attached a name, because the product does not serve names yet. You have no product. You are still choosing who will build, and the document in front of you is a term sheet. The criteria for that choice sit on the page written for a top saas development company. That page is criteria. It does not rank anyone, including us. The only fact in the room is a share from a paper. 9.1 is not your zone, and 467 is not your zone. A name you used to serve is already answering for someone else. Leaving a row in a database does not get it back. That is an incident, and the first hour is not this audit. Or you wanted a lawyer to say whether a registration is yours. Hire the lawyer.

When the name is real and the zone is not on a screen you can open, the missing object is specific. An admin action, in an account you administer, that shows one hostname's record, shows a released target is not still that customer's, and shows a different customer's name still resolving. A startup software development company that expects this will have put that action next to the rest of account admin, before a custom name is the way you discover the vendor owns the zone. One that needs a call in order for you to see where a name points is telling you who holds the record. If the first slice is a fixed capability, an AI integration sprint is the shape where the acceptance sentence can include the three proofs. If you do not yet know which system answers the name, a two-week AI readiness assessment maps the systems. The findings are yours. They are not a promise that a paper's share applies, and they are not a rate.

A check a merge was waiting on, and a reason a model stopped, are different objects: name the check the merge required and name the stop the response carried. Do not record either on this page. A status is not a DNS record. A stop reason is not a hostname.

Before you tell them the name is theirs, do the three proofs and write the target. Show the record. Show a name you released is not still routed to them. Show someone else's name still resolving. Do not delete the account to avoid the zone, and do not ask a model to remember a CNAME. A paper can count dangling names on a public list. The record in your zone is the page you can defend.