dns
Safeguard articles tagged "dns" — guides, analysis, and best practices for software supply chain and application security.
5 articles
A Revocation Is Not Effective Until Every Cache Agrees
You remove a vendor's IP from an allowlist and the firewall updates immediately. It does not update every client that already resolved the hostname and cached the answer, some of which will keep connecting to the old address for as long as their TTL says they may.
A Half-Deleted Service Is More Dangerous Than a Running One
Services are launched with a checklist and switched off with a Slack message. The container goes, the credentials stay, and nobody patches or monitors something everyone believes is gone.
The Subdomain You Forgot Is Someone Else's Now
A CNAME outlives the vendor account it pointed at, the platform frees the hostname, and anyone can claim it. The damage is rarely the defaced page: it is parent-domain cookies, OAuth redirects and a CSP that trusts subdomains.
Microsoft May 2026 Patch Tuesday: No Zero-Days, but Two CVSS 9.8 Wormable RCEs
Microsoft's May 2026 Patch Tuesday shipped without a single exploited zero-day for the first time since June 2024, but it still carried two unauthenticated CVSS 9.8 remote code execution bugs in core Windows services that every domain should treat as emergency patches.
When DNSSEC Goes Wrong: The .de TLD Signing Failure That Took Down German Domains (May 5, 2026)
On May 5, 2026, DENIC published unvalidatable DNSSEC signatures for the .de zone after a deployment defect made its signer generate three key pairs instead of one. Validating resolvers worldwide, including Cloudflare's 1.1.1.1, were forced to return SERVFAIL.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.