I am a fairly security conscious web developer. One of my clients has their website hosted outside their corporate system, but all other services, including email and domain services go through their corporate IT Dept.
Their web host changed IP addresses, so I sent the new information to the corporate office for them to make changes to the A records. In response, they sent their local contact a text file that seems to be a dump of all the DNS information. That person didn't know what it was and forwarded it to me. The file includes:
- SOA Record
- A Records
- CNAME Records
- MX Records
- TXT Records
The only information that is relevant to me, as an outside contractor are two A records. Am I correct in thinking that sending me that file through regular email channels is a security hole?
In the end, having the MX records helped me troubleshoot a separate web form problem, but that doesn't seem to be justification for me to have information about all the services they use.