Lion Cipher Lab
Lint a DNS zone file for hygiene and correctness problems
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A DNS zone file is the source of truth for a domain: it maps names to addresses, mail servers, and policy records. A mistake in it does not throw an error — it just quietly breaks something or opens a hole. A CNAME at the zone apex or sitting alongside other records is illegal and makes resolvers behave unpredictably. A CNAME pointing at a name that no longer exists is a dangling record, the raw material for subdomain takeover. An MX or NS record pointing at a CNAME violates the DNS spec and breaks mail or delegation. An SPF record that ends in '+all' authorizes the entire internet to send…
What you'll learn
- reading a BIND-style zone file
- catching illegal CNAME usage (apex, coexistence, MX/NS targets)
- finding dangling in-zone CNAMEs
- flagging an SPF record that authorizes any sender
- spotting wildcard records and churn-inducing low TTLs
- the limits of a focused linter versus a full resolver
Steps in this lab
- A zone file fails quietly
- The zone to audit
- Write the linter
- Run it: six findings, sorted by severity
- Extend it, and know its blind spot