News for hackers. Stuff that matters.
Re:We scanned DNS TXT records for the Fortune 500 and here's... by Bender on Wednesday January 21, 2026 @08:03AM (#46705142)
I would also add that these dangling TXT records also build up into a amplification DDoS risk for recursive name servers. When running public recursive servers I have had to strip the TXT records for several domains including but not limited to 500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com. Take a look:

    for i in $(echo "500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com");do dig +short +nocookie -t TXT "${i}";echo;done
To strip them in Unbound I used:

    local-zone: ebay.com typetransparent
    local-data: 'ebay.com. TXT "[ddos redacted]"'
My public name servers served a specific purpose so stripping such records were perfectly splendid.
Re:We scanned DNS TXT records for the Fortune 500 and here's... by shakauy on Wednesday January 21, 2026 @08:58AM (#46705784)
Indeed! Good point, TXT records pile up fast with SPF, DKIM, DMARC, and vendor checks, which increases amplification risk for resolvers, and it's the same sprawl we’re seeing as long-lived infrastructure signals from the outside!