{"id":3007,"date":"2026-11-12T14:56:18","date_gmt":"2026-11-12T14:56:18","guid":{"rendered":"https:\/\/hostry.com\/blog\/?p=3007"},"modified":"2026-11-12T14:56:18","modified_gmt":"2026-11-12T14:56:18","slug":"stale-dns-records-after-deleting-vps","status":"publish","type":"post","link":"https:\/\/hostry.com\/blog\/stale-dns-records-after-deleting-vps\/","title":{"rendered":"Stale DNS Records After Deleting a VPS: Find and Remove Them"},"content":{"rendered":"\n
\"Stale<\/figure>\n\n\n\n
Once the IP of a VPS you deleted goes to another customer, plain HTTP to its old subdomain can return their site with status 200. If the server is already gone, list your records, run the audit below and confirm each flag before removing anything. For a server you still run, remove DNS first and delete the server last.<\/strong><\/em><\/pre>\n\n\n\n
Stale DNS records point at a server or service you no longer control; the audit below works with any DNS provider, Hostry free DNS hosting<\/a><\/strong> included.<\/p>\n\n\n\n
Every output block below was reproduced with NSD 4.8.0, unbound 1.19.2, curl 8.5.0 and OpenSSL 3.0.13 on Ubuntu 24.04.5 LTS, in network namespaces on one machine. Timings reflect Linux defaults there and will differ elsewhere. Names and addresses are documentation examples; put your own zone and IPs in their place.<\/p>\n\n\n\n
What a stale A record does after the server is gone<\/h2>\n\n\n\n
A DNS record pointing to an old IP keeps resolving as if nothing had changed. Resolvers answer NOERROR with the address, and the failure appears only when a client opens a TCP connection, in a form that depends on what now sits at that IP.<\/p>\n\n\n\n
$ dig api.example.com A\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53350\n;; ANSWER SECTION:\napi.example.com.    230    IN    A    198.51.100.41<\/code><\/pre>\n\n\n\n
Security write-ups call a stale DNS record a dangling DNS record. The CNAME variant is an alias whose target, such as a hosted docs site, was deleted. For a VPS the usual leftover is an A record, because deleting a server does nothing to a zone hosted elsewhere.<\/p>\n\n\n\n
What sits at the old IP<\/th>curl result<\/th>Time to fail<\/th><\/tr><\/thead>
Nothing, packets dropped, curl defaults<\/td>exit 28<\/td>134.4 s<\/td><\/tr>
Nothing, packets dropped, –connect-timeout 5<\/span><\/td>exit 28<\/td>5.0 s<\/td><\/tr>
Closed port or a firewall REJECT<\/td>exit 7, connection refused<\/td>under 1 ms<\/td><\/tr>
Another customer’s server, HTTPS, valid certificate for its own name<\/td>exit 60, certificate name mismatch<\/td>4 ms<\/td><\/tr>
The same server, plain HTTP<\/td>status 200 with their page<\/td>no failure<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
In the first three rows, nothing serves content for your name yet. The last two follow once the provider hands the IP to someone else, who then receives the traffic meant for you, as a 2019 APNIC blog post on stale DNS records<\/a><\/strong> describes. Reassignment speed depends on the provider’s pool, so treat the record as a live risk from the moment the server is deleted.<\/p>\n\n\n\n
\"What<\/figure>\n\n\n\n
That 134.4-second hang in the first row is the kernel retransmitting the SYN: with net.ipv4.tcp_syn_retries<\/span> at its default of 6, the kernel’s ip-sysctl documentation<\/a><\/strong> puts the final timeout at about 131 seconds. Set the curl –connect-timeout option<\/a><\/strong> in health checks that might call an old name, and branch on the exit code: curl printed “Couldn’t connect to server” for exit 7 and for the 134-second exit 28.<\/p>\n\n\n\n
Put every record in one list first<\/h2>\n\n\n\n
Give the audit a plain text file with one record per line, written as name type value<\/span> with full names. Copy the records from your panel into records.txt<\/span>; subdomains nobody wrote down are the ones missed at teardown, so take the names from the panel itself. Lines starting with # or ; are skipped, and any run of spaces separates the columns. Hostry free DNS<\/a><\/strong> has no limits on the number of records or queries, so test and staging names can share the production zone and this one list.<\/p>\n\n\n\n
# pasted from the DNS panel of example.com\nexample.com          NS     ns1.example.com\nexample.com          A      198.51.100.17\nwww.example.com      A      198.51.100.17\napi.example.com      A      198.51.100.41\nstaging.example.com  A      198.51.100.62\ngrafana.example.com  A      203.0.113.88\ndocs.example.com     CNAME  example-docs.pages.example.net\nuptime.example.com   CNAME  uptime-page.example.net\nexample.com          MX     10 mail.example.com\nexample.com          MX     20 mx-old.example.com\nmail.example.com     A      198.51.100.17\nmx-old.example.com   A      198.51.100.62\nexample.com          TXT    \"v=spf1 mx a:mail.example.com ip4:198.51.100.17 ip4:198.51.100.40\/29 ip6:2001:db8:41::\/48 include:_spf.example.net -all\"\n_sip._tcp.example.com SRV   10 5 5060 api.example.com<\/code><\/pre>\n\n\n\n
MX and SRV lines keep priority, weight and port before the target; the script takes the last field as the host. TXT values keep their quotes. A long SPF record split into two quoted strings is joined before checking.<\/p>\n\n\n\n
A BIND-style zone export is not read as is, because its TTL or IN column lands in the type field. This awk line cuts each record down to the three fields and writes @ and relative names out in full; put your domain after -v o=<\/span>. Records that span several lines in parentheses are not joined, so check those by hand.<\/p>\n\n\n\n
awk -v o=example.com. '$1==\"$ORIGIN\"{o=$2;next} $1~\/^[;$]\/||NF<2{next} {sub(\/[ \\t]+;.*\/,\"\"); i=1; if(\/^[^ \\t]\/){n=$1; i=2; if(n==\"@\")n=o; else if(n!~\/\\.$\/)n=n\".\"o} while($i~\/^[0-9]\/||toupper($i)==\"IN\")i++; if($i!~\/^[A-Za-z]\/)next; v=$(i+1); for(k=i+2;k<=NF;k++)v=v\" \"$k; print n, $i, v}' example.com.zone > records.txt<\/code><\/pre>\n\n\n\n
Your second input is the retired list: the IPv4 and IPv6 addresses of every server you have deleted, as far back as billing history or old notes go.<\/p>\n\n\n\n
A file saved on Windows needs no conversion, and a last line with no newline after it is read too. In the reproduction, the carriage return at each line end (shown as ^M) made every A record look dead until the script was changed to strip it:<\/p>\n\n\n\n
www.example.com A 198.51.100.17^M\n  dns     !! listed 198.51.100.17^M, DNS answers '198.51.100.17' (NOERROR)\n  tcp     !! 22 unreachable, 80 unreachable, 443 unreachable: nothing answers, server gone?<\/code><\/pre>\n\n\n\n
Find stale DNS records with an 80-line script<\/h2>\n\n\n\n
Run audit-dns.sh<\/span> with the record list and the retired addresses as arguments. For each A or AAAA record it compares DNS with the list, tries ports 22, 80 and 443, reads the certificate name and looks up the PTR. CNAME targets are checked for NXDOMAIN and NODATA, and every value is matched against the retired IPs.<\/p>\n\n\n\n
It needs bash, dig (the bind9-dnsutils package on Ubuntu 24.04), openssl and timeout<\/span> from coreutils; ports are tested through bash’s own \/dev\/tcp. It only reads: name lookups, one TCP connection per port, one TLS handshake.<\/p>\n\n\n\n
sudo apt install bind9-dnsutils openssl<\/code><\/pre>\n\n\n\n
It suits a zone of a few dozen records, because checks run one after another. A host that listens only on 25 or 5060 is reported as nothing answering; add its port to the for p in 22 80 443<\/span> loop. The IPv6 connection test is unverified: the reproduction had no IPv6, so every AAAA came back unreachable. The TLS check reads the certificate name and expiry only and skips chain verification.<\/p>\n\n\n\n
#!\/usr\/bin\/env bash\n# audit-dns.sh - find DNS records that still point at servers you deleted.\n# Usage: .\/audit-dns.sh records.txt [retired-ip ...]\n#   records.txt: one record per line, \"name type value\", full names, copied from your DNS panel:\n#     www.example.com A 198.51.100.17\n#     example.com TXT \"v=spf1 ip4:198.51.100.40\/29 -all\"\n#   retired-ip: addresses of servers you deleted; every A, AAAA, MX, SRV, CNAME and TXT value is checked.\n# Env: TIMEOUT (seconds per check, default 3), RESOLVER (e.g. 1.1.1.1; default: system resolver).\n# Read-only: it resolves names, opens TCP connections to the listed IPs and reads TLS certificates.\n# Exit: 0 nothing flagged, 1 something flagged, 2 no arguments, or records file missing, unreadable or without records.\nset -uf    # no globbing: SPF tokens like ?all stay literal\n(( $# )) || { echo \"usage: ${0##*\/} records.txt [retired-ip ...]\" >&2; exit 2; }\nlist=$1; shift; retired=(\"$@\")\n[[ -r $list && ! -d $list ]] || { echo \"cannot read records file: $list\" >&2; exit 2; }\nT=${TIMEOUT:-3}; at=${RESOLVER:+@$RESOLVER}; flags=0 seen=0\nsay()  { printf '  %-7s %s\\n' \"$1\" \"$2\"; }\nflag() { say \"$1\" \"!! $2\"; flags=$((flags+1)); }\nip4n() { local IFS=.; set -- $1; echo $(( ($1<<24)|($2<<16)|($3<<8)|$4 )); }\nip6x() { local a=${1,,} l r i out=(); l=$a; r=\"\"          # IPv6 -> 32 hex digits\n  [[ $a == *::* ]] && { l=${a%%::*}; r=${a#*::}; }\n  IFS=: read -ra L <<<\"$l\"; IFS=: read -ra R <<<\"$r\"; out=(\"${L[@]}\")\n  for ((i=${#L[@]}+${#R[@]}; i<8; i++)); do out+=(0); done\n  for i in \"${out[@]}\" \"${R[@]}\"; do printf '%04x' \"0x$i\"; done; }\nin_net() { local ip=$1 net=${2%\/*} len=\"\"; [[ $2 == *\/* ]] && len=${2#*\/}   # is IP inside NET[\/LEN]?\n  if [[ $ip == *:* && $net == *:* ]]; then\n    local a b n; a=$(ip6x \"$ip\"); b=$(ip6x \"$net\"); len=${len:-128}; n=$((len\/4))\n    [[ ${a:0:n} == \"${b:0:n}\" ]] || return 1\n    (( len%4 == 0 || (0x${a:n:1} >> (4-len%4)) == (0x${b:n:1} >> (4-len%4)) ))\n  elif [[ $ip != *:* && $net =~ ^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$ ]]; then\n    len=${len:-32}; local m=$(( len ? (0xFFFFFFFF << (32-len)) & 0xFFFFFFFF : 0 ))\n    (( ($(ip4n \"$ip\") & m) == ($(ip4n \"$net\") & m) ))\n  else return 1; fi; }\nretired_in() { local r; for r in \"${retired[@]}\"; do in_net \"$r\" \"$2\" && flag retired \"$1 $2 covers retired IP $r\"; done; }\nq() { local out; out=$(dig $at +noall +comments +answer \"$1\" \"$2\" 2>&1)   # sets $st and $ans\n  st=$(grep -o 'status: [A-Z]*' <<<\"$out\"); st=${st#status: }; st=${st:-NO-REPLY}\n  ans=$(awk -v t=\"$2\" '$4==t {print $5}' <<<\"$out\" | tr '\\n' ' '); ans=${ans% }; }\nport() { local err; err=$(timeout \"$T\" bash -c \": <\/dev\/tcp\/$1\/$2\" 2>&1)\n  case $? in 0) echo open;; 124) echo timeout;; *) [[ $err == *refused* ]] && echo refused || echo unreachable;; esac; }\ntls() { local hp=$2:443 pem san; [[ $2 == *:* ]] && hp=\"[$2]:443\"\n  pem=$(timeout \"$T\" openssl s_client -connect \"$hp\" -servername \"$1\" <\/dev\/null 2>\/dev\/null | openssl x509 2>\/dev\/null)\n  [[ -z $pem ]] && { flag tls \"port 443 is open but no certificate came back\"; return; }\n  san=$(openssl x509 -noout -ext subjectAltName <<<\"$pem\" | tail -n +2 | tr -d ' ')\n  if ! openssl x509 -noout -checkhost \"$1\" <<<\"$pem\" | grep -q 'does match'; then flag tls \"certificate is for ${san:-?}, not $1\"\n  elif ! openssl x509 -noout -checkend 0 <<<\"$pem\" >\/dev\/null; then flag tls \"certificate for $1 has expired\"\n  else say tls \"ok: certificate covers $1\"; fi; }\n\nwhile read -r name type value <&3 || [[ -n $name ]]; do   # || ...: last line without a newline\n  name=${name%$'\\r'}; [[ -z $name || $name == [\\#\\;\\$]* ]] && continue; seen=$((seen+1))\n  value=${value%$'\\r'}; name=${name%.}; type=${type^^}; value=${value%.}; echo \"$name $type $value\"   # \\r: Windows line ends\n  case $type in\n  A|AAAA) q \"$name\" \"$type\"\n    [[ \" $ans \" == *\" $value \"* ]] && say dns \"ok: resolves to $value\" || flag dns \"listed $value, DNS answers '${ans:-nothing}' ($st)\"\n    r=\"\"; up=0; for p in 22 80 443; do s=$(port \"$value\" $p); r+=\"$p $s, \"; [[ $s == open ]] && up=1; done\n    (( up )) && say tcp \"${r%, }\" || flag tcp \"${r%, }: nothing answers, server gone?\"\n    [[ $r == *\"443 open\"* ]] && tls \"$name\" \"$value\"\n    ptr=$(dig $at +short -x \"$value\" 2>\/dev\/null | head -1); say ptr \"${ptr:-none}\"\n    retired_in \"$type\" \"$value\";;\n  CNAME) q \"$name\" CNAME; [[ ${ans%.} == \"$value\" ]] || flag dns \"listed $value, DNS answers '${ans:-nothing}' ($st)\"\n    q \"$value\" A; [[ $st == NOERROR && -z $ans ]] && q \"$value\" AAAA\n    case $st in\n      NXDOMAIN) flag cname \"target $value does not exist (NXDOMAIN): dangling\";;\n      NOERROR) if [[ -n $ans ]]; then say cname \"ok: target resolves to $ans\"; for a in $ans; do retired_in \"target\" \"$a\"; done\n               else flag cname \"target $value exists but has no A\/AAAA (NOERROR, empty answer)\"; fi;;\n      *) flag cname \"target lookup failed: $st\";; esac;;\n  MX|SRV) tgt=${value##* }; tgt=${tgt%.}; q \"$tgt\" A; a4=$ans; s4=$st; q \"$tgt\" AAAA; ans=$(echo $a4 $ans)\n    [[ -n ${ans\/\/ } ]] && say \"${type,,}\" \"$tgt -> $ans\" || flag \"${type,,}\" \"target $tgt has no address ($s4)\"\n    for a in $ans; do retired_in \"$type $tgt ->\" \"$a\"; done;;\n  TXT) v=$(sed 's\/\" *\"\/\/g; s\/\"\/\/g' <<<\"$value\"); n=0\n    for tok in $v; do t=${tok#[-+~?]}\n      case ${t,,} in\n        ip4:*|ip6:*) retired_in \"${t%%:*}\" \"${t#*:}\";;\n        include:*|a|a[:\/]*|mx|mx[:\/]*|ptr|ptr:*|exists:*|redirect=*) n=$((n+1));;\n        [0-9]*.*.*.*) retired_in TXT \"$t\";;\n      esac; done\n    [[ $v == v=spf1* ]] && say spf \"$n DNS-lookup terms at this level (limit 10, nested includes count too)\";;\n  *) say skip \"type $type not checked\";;\n  esac\ndone 3< \"$list\"\n(( seen )) || { echo \"no records read from $list\" >&2; exit 2; }\necho; echo \"$flags item(s) need attention\"; (( flags == 0 ))   # exit 1 if anything was flagged (for cron)<\/code><\/pre>\n\n\n\n
On line 11, set -uf<\/span> stops ?all in an SPF record from expanding as a shell glob.<\/p>\n\n\n\n
chmod +x audit-dns.sh\n.\/audit-dns.sh records.txt 198.51.100.41 198.51.100.62 2001:db8:41::41<\/code><\/pre>\n\n\n\n
TIMEOUT (3 seconds per check) and RESOLVER come from the environment. RESOLVER must name a recursive resolver, because an authoritative-only server answers REFUSED for zones it does not serve.<\/p>\n\n\n\n
RESOLVER=1.1.1.1 .\/audit-dns.sh records.txt 198.51.100.41 198.51.100.62 2001:db8:41::41<\/code><\/pre>\n\n\n\n
Against the sample zone, served by a local NSD, the first command reported 15 findings for 14 records in 10.5 seconds. About 9 of those seconds went to the one address that drops packets: three ports at three seconds each. The 15 are three hosts where nothing answers, two certificates for another name, two CNAME problems and eight retired-IP matches. One match is the AAAA record of api.example.com, which the SRV check found in the zone though records.txt does not list it, so totals depend on the zone too.<\/p>\n\n\n\n
[...]\napi.example.com A 198.51.100.41\n  dns     ok: resolves to 198.51.100.41\n  tcp     !! 22 timeout, 80 timeout, 443 timeout: nothing answers, server gone?\n  ptr     api.example.com.\n  retired !! A 198.51.100.41 covers retired IP 198.51.100.41\nstaging.example.com A 198.51.100.62\n  dns     ok: resolves to 198.51.100.62\n  tcp     !! 22 refused, 80 refused, 443 refused: nothing answers, server gone?\n  ptr     none\n  retired !! A 198.51.100.62 covers retired IP 198.51.100.62\ngrafana.example.com A 203.0.113.88\n  dns     ok: resolves to 203.0.113.88\n  tcp     22 open, 80 open, 443 open\n  tls     !! certificate is for DNS:cp.example.net, not grafana.example.com\n  ptr     none\ndocs.example.com CNAME example-docs.pages.example.net\n  cname   !! target example-docs.pages.example.net does not exist (NXDOMAIN): dangling\nuptime.example.com CNAME uptime-page.example.net\n  cname   !! target uptime-page.example.net exists but has no A\/AAAA (NOERROR, empty answer)\n[...]\nexample.com MX 20 mx-old.example.com\n  mx      mx-old.example.com -> 198.51.100.62\n  retired !! MX mx-old.example.com -> 198.51.100.62 covers retired IP 198.51.100.62\nmail.example.com A 198.51.100.17\n  dns     ok: resolves to 198.51.100.17\n  tcp     22 open, 80 open, 443 open\n  tls     !! certificate is for DNS:www.example.com,DNS:example.com, not mail.example.com\n  ptr     www.example.com.\n[...]\nexample.com TXT \"v=spf1 mx a:mail.example.com ip4:198.51.100.17 ip4:198.51.100.40\/29 ip6:2001:db8:41::\/48 include:_spf.example.net -all\"\n  retired !! ip4 198.51.100.40\/29 covers retired IP 198.51.100.41\n  retired !! ip6 2001:db8:41::\/48 covers retired IP 2001:db8:41::41\n  spf     3 DNS-lookup terms at this level (limit 10, nested includes count too)\n[...]\n\n15 item(s) need attention<\/code><\/pre>\n\n\n\n
Look at grafana.example.com first. Its address was left off the retired list on purpose, playing a server the owner forgot, and the audit flagged it anyway because the IP now serves a certificate for cp.example.net<\/strong>. Its DNS answer and open ports looked healthy. Without the certificate check, that stale DNS record would have passed.<\/p>\n\n\n\n
The mail.example.com flag is harmless, because that shared web server returns its default certificate for a name it does not host. The PTR line is informational; the provider controls it. The expiry test (-checkend 0<\/span>) also catches a renewal job that quietly stopped, which matters more as Let’s Encrypt moves to 45-day certificates<\/a><\/strong>.<\/p>\n\n\n\n
Remove a stale DNS record only after confirming that its host is retired:<\/p>\n\n\n\n
Flag<\/th>Next step<\/th><\/tr><\/thead>
retired<\/span>: a value covers a retired IP<\/td>Delete the A or AAAA record; for SPF and MX, see the SPF section below.<\/td><\/tr>
tls<\/span>: certificate for another name<\/td>Rule out a shared server’s default certificate (mail.example.com); for a name nobody hosts, like grafana, add its IP to the retired list.<\/td><\/tr>
cname<\/span>: NXDOMAIN or no address<\/td>Read the status line (dig checks below), then delete the alias or restore its target.<\/td><\/tr>
tcp<\/span>: nothing answers<\/td>Confirm in the provider’s panel or billing that the server is gone.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Two checks that mislead: dig +short and x509 -checkhost<\/h3>\n\n\n\n
dig +short<\/span> prints nothing both for NXDOMAIN and for NODATA (the name exists but has no A record), so it cannot tell a deleted target from one that only lost its address. Pointed at the alias of a dangling CNAME, it prints the target and looks healthy, while the full answer’s status line says NXDOMAIN:<\/p>\n\n\n\n
$ dig +short docs.example.com A\nexample-docs.pages.example.net.\n$ dig docs.example.com A | grep status\n;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28988<\/code><\/pre>\n\n\n\n
openssl x509 -checkhost<\/span> fails in the opposite direction. In OpenSSL 3.0.13 it exits 0 whether or not the name matches, so a script that tests its return code passes every certificate:<\/p>\n\n\n\n
$ openssl s_client -connect 203.0.113.88:443 -servername grafana.example.com <\/dev\/null 2>\/dev\/null \\\n    | openssl x509 -noout -checkhost grafana.example.com; echo \"x509 exit=$?\"\nHostname grafana.example.com does NOT match certificate\nx509 exit=0\n$ openssl s_client -connect 198.51.100.17:443 -servername www.example.com <\/dev\/null 2>\/dev\/null \\\n    | openssl x509 -noout -checkhost www.example.com; echo \"x509 exit=$?\"\nHostname www.example.com does match certificate\nx509 exit=0<\/code><\/pre>\n\n\n\n
That is why the script greps for “does match”. If you need a result code, use openssl s_client<\/span> with -verify_hostname<\/span>; in the reproduction, with the lab CA trusted, it printed “Verify return code: 62 (hostname mismatch)” for grafana and “0 (ok)” for www.example.com. Without a locally trusted chain a chain error can take its place, such as code 21 (unable to verify the first certificate). Even on a mismatch, s_client exits 0 unless you add -verify_return_error<\/span>.<\/p>\n\n\n\n
SPF and MX: where an old IP address keeps working<\/h2>\n\n\n\n
An SPF record with an old IP address keeps authorizing that address after the server is gone, and a stale MX record does the same through the mx mechanism. In the reproduction, the deleted server 198.51.100.41 sat inside ip4:198.51.100.40\/29<\/span>, and both pyspf 2.0.14 and libspf2 1.2.10 returned pass for it. Both tools are in Ubuntu’s universe repository (sudo apt install python3-spf spfquery<\/span>); spf.py may also print a SyntaxWarning.<\/p>\n\n\n\n
$ python3 \/usr\/lib\/python3\/dist-packages\/spf.py 198.51.100.41 postmaster@example.com mail.example.com\nresult: ('pass', 250, 'sender SPF authorized') ip4:198.51.100.40\/29\n$ python3 \/usr\/lib\/python3\/dist-packages\/spf.py 198.51.100.62 postmaster@example.com mail.example.com\nresult: ('pass', 250, 'sender SPF authorized') mx\n$ spfquery -ip 198.51.100.41 -sender postmaster@example.com -helo mail.example.com\npass\n[...]<\/code><\/pre>\n\n\n\n
Address 198.51.100.62 appears in no ip4 entry at all. It passes because the MX record for mx-old.example.com still resolves to it and the SPF record starts with mx. Whoever is assigned either address next can send mail that passes SPF for your domain. For each retired address:<\/p>\n\n\n\n