Re:We scanned DNS TXT records for the Fortune 500 and here's...
by Bender on Wednesday January 21, 2026 @08:03AM
(#46705142)
I would also add that these dangling TXT records also build up into a amplification DDoS risk for recursive name servers. When running public recursive servers I have had to strip the TXT records for several domains including but not limited to 500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com. Take a look:
To strip them in Unbound I used:
My public name servers served a specific purpose so stripping such records were perfectly splendid.
[ Parent
| on HN ]
Re:We scanned DNS TXT records for the Fortune 500 and here's...
by shakauy on Wednesday January 21, 2026 @08:58AM
(#46705784)
Indeed! Good point, TXT records pile up fast with SPF, DKIM, DMARC, and vendor checks, which increases amplification risk for resolvers, and it's the same sprawl we’re seeing as long-lived infrastructure signals from the outside!