Verisign recently put a name to a problem security teams have quietly lived with for years: stale trust . In their framing, it is the gap between the credentials your systems trust and the credentials that are actually still trustworthy . Their focus is certificate revocation. When a certificate is revoked but a client checks its status against cached data, the client keeps trusting it. Verisign notes that depending on how a service is implemented, that validation data can be as much as 10 days old.

It is a useful idea, and it applies well beyond certificates. The same pattern, trust granted once and never re-checked, is one of the most common and most exploited weaknesses in DNS. The difference is that in DNS, the stale data is not cached for 10 days. It often sits in your zone for years.

What stale trust looks like in DNS

Every DNS record is a statement of trust.…