Public DNS address validation
How fresh A and AAAA resolution keeps an authorized external scan on public destinations—and what this safety check does not assess.
Reviewed
Check identity
dns.public-addresses- Finding
- No retained finding
- Severity
- Not applicable
What the check observes
The scanner resolves the authorized hostname immediately before network activity and evaluates every returned A and AAAA address.
A run continues only when the resolved destination set is public and allowed by the scan policy. Connections are pinned to validated addresses, and redirects are revalidated.
Private, loopback, link-local, multicast, metadata, reserved, non-public, and mixed public/non-public destination sets are rejected rather than scanned.
Why the result matters
DNS can change between authorization and execution. Fresh resolution narrows the gap between the hostname an organization approved and the address the worker contacts.
Treating every address in a response as part of the decision helps prevent a public hostname from steering the scanner toward internal or infrastructure-sensitive services.
How to investigate
- 1
Review the hostname’s current A and AAAA records in the authoritative DNS provider.
- 2
Check whether a recent DNS, CDN, proxy, or load-balancer change introduced an unexpected address family or destination.
- 3
Confirm that every returned address is intended to be publicly reachable for the exact authorized hostname.
Remediation steps
- 1
Remove stale or unintended records from the authoritative DNS zone.
- 2
Correct proxy, CDN, or load-balancer origin configuration if a public name resolves to a non-public destination unexpectedly.
- 3
Wait for the intended DNS change to become observable, then run a new authorized scan. Do not bypass the address policy to force a run.
Verify the change
Resolve both A and AAAA records from a trusted administrative environment and compare them with the intended public endpoints.
Re-run the authorized scan and confirm the public-address check completes without an address-policy error.
Limits of this check
- A passing result means the addresses observed for that run met the public-destination policy. It does not validate DNSSEC, zone-transfer controls, domain-registration security, resolver integrity, or the security of the services at those addresses.
- DNS state can change after a scan. Continuous scheduling provides repeated observations, not a guarantee of future resolution behavior.