Domain exposure sweeps

What a certificate log is

A website’s certificate is what lets a browser show the padlock. Each time a certificate authority issues one, it records it in public certificate logs. Browsers ask for this, so nearly every certificate is there. The logs are public, so they hold most names a business has put on the web, including old test sites and names nobody remembers.

The sweep searches the logs through crt.sh, a free service run by Sectigo. It sends crt.sh only the domain’s name. The answer is kept for a day, so a second sweep of the same domain that day does not ask again.

What is checked for each name

Each name is looked up in public DNS, the same way anyone’s computer would look it up. No web server is visited.

• Where it points, following up to five steps, and whether what it points at still exists.
• Whether it points at a private address, which reveals a name inside the network.
• Whether it receives mail, and whether it has an SPF record.
• Which DMARC policy covers it: its own, or the one the domain sets for names under it.
• When its newest certificate in the logs ended, or ends in the next 30 days.

The sweep comes as a Word document for the client, with the names to fix first at the top, and an Excel sheet with every name. It changes nothing in DNS or anywhere else.

Pointing at a service name that no longer exists

A DNS record can point a name such as old.contoso.com at a name a cloud service gave out, such as contoso-old.azurewebsites.net. When the service is deleted and the record is not, the record points at a name that no longer exists.

For some services, another customer of that cloud may be able to create a new service with the name that is now free. They could then show their own content on old.contoso.com, under the client’s domain. This is often called a subdomain takeover.

What to do:

• If nothing needs the name, remove the record. This is the usual fix.
• If the name is still wanted, create the service again yourself, with the same name, before anyone else does.
• For Azure App Service, a domain verification record (asuid. and the name) makes Azure check who owns the domain before another subscription can use it. The sweep says when one is there. The record still points nowhere, so remove it if nothing needs it.

Why it says “may”

Whether someone else can take a name depends on the service. Microsoft lists the Azure services where a deleted name can be created again. The sweep names only these:

• Azure App Service (azurewebsites.net)
• Azure public IP address (cloudapp.azure.com)
• Azure Traffic Manager (trafficmanager.net)
• Azure Storage (blob.core.windows.net)
• Azure Front Door (azurefd.net)
• Azure API Management (azure-api.net)
• Azure Container Instances (azurecontainer.io)

For any other name that no longer exists, the sweep says only that, and suggests removing the record if nothing needs it. It never says a name has been taken, or will be.

What it does not do

• It finds only names that have had a public certificate. Names covered only by a wildcard certificate (*.contoso.com) are not listed one by one.
• “Pointing at a service name that no longer exists” means the name it points at does not exist now. A record pointing at a service that still answers for anyone, or at an address released back to a cloud provider, is not found this way.
• Whether someone else can take a name depends on the service: the sweep says “may”, and names the services Microsoft lists.
• Certificate dates come from the public logs, not from the web server: a name may be served with a wildcard certificate instead.
• Names that answer only inside the client’s network are not checked.
• Public certificate logs are searched through crt.sh, a free service run by Sectigo. When it does not answer, or a domain has more certificates than it can return, no sweep is made and the credits are given back.
• At most 300 names a sweep. Names that could not be checked are listed as such; the credits come back only when more than half could not be checked.
• It reads public certificate logs and public DNS; it visits no web server. It changes nothing.