What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them?

The example below is from the "have i been pwned" Web site:

enter image description here

  • Would be nice if you can put an example of what are the third party tools, also why you want to add external txt records to your dns server? would you mind to clarify the scenario. – camp0 May 6 at 19:52
  • example: Looking into using haveibeenpwned domain search tool. – john_zombie May 6 at 19:58
  • it requires to add a TXT record. – john_zombie May 6 at 19:58
  • No problem on use that service, in fact, some of the people that I work with them use the service. I don't see any risk on that may be other users can see other risks – camp0 May 6 at 20:04

Yes, under certain circumstances, they can.

TXT records are frequently used to verify the domain name ownership for various reasons, including (but not limited to) TLS (HTTPS) certificate issuance. For instance, this is how it is done with DigiCert which is one of, if not the, largest certificate authority in the world.

Note that the process is just the same as in your case: you need to take a seemingly arbitrary alphanumeric string (provided to you by the tool) and to put it in the TXT record of your domain.

A potential attacker can supply you with a string they have obtained from a CA's validation agent on your behalf and then obtain a valid HTTPS certificate for your domain. The certificate could then in turn be used e.g. for man-in-the-middle attacks against your Web site.

To address that scenario, most validation agents these days generate not just an arbitrary alphanumeric string for a TXT record but a string with a prefix which is expected to rather uniquely identify the validation agent. At the time of writing, the service you have mentioned seems to do exactly that: it just provided me with a string have-i-been-pwned-verification=e6c252c87a4bd0e0fd7cb39a057bb0b3, which contains an easily recognizable and apparently innocent prefix have-i-been-pwned-verification=.

See, it's highly unlikely that a different Web service (including CAs) would issue anyone a string with exactly that prefix.

(Make sure the prefix still stays there when you are going through validation.)

Aside from potential (and severe, thus unlikely) vulnerabilities in validation agents, prefixed strings with long and seemingly unique prefixes may be considered safe to put into a TXT record for a rather short period of time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.