Move the CNAME to an internal name out of public DNS

Why it matters

A public record points at a private-use name such as .local, .internal or .corp. Nobody can register such a name, so it is not a takeover risk, but it tells anyone who looks the name of an internal host and the record fails for every visitor outside your network.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find the CNAME in the public zone, using the name from the finding, and check who uses it. Usually it serves staff on the office network or VPN.
2. If those users resolve names through an internal DNS server, add the record to that internal zone (split-horizon DNS) and check that it resolves there.
3. Then delete the record from the public zone. Users outside the network lose nothing, because the target never resolved for them.
4. If the service should be reachable from the internet, point the record at a public name or address you control instead.
5. Review the public zone for other records that point at internal names or private addresses.

# replace sub with the subdomain named in the finding
dig CNAME sub.example.com +short
# from inside the network, through the internal resolver
dig sub.example.com

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Dangling CNAMEs check
• Delete the CNAME that points at an unregistered domain
• Remove or reclaim the CNAME to a deprovisioned service
• Delete the CNAME that points at a name that does not exist
• Fix the wildcard CNAME that points at a missing name