Azure/Azure-Network-Security

CNAMEs pointing to Azure Frontdoor endpoints in Standard Pricing tier report as dangling.

lawrencewilson opened this issue · 2 comments

lawrencewilson commented

Describe the bug
Dangling DNS Finder is not able to recognize Azure front door endpoints that are created against the Front Door and CDN profiles in the Azure Front Door Standard pricing tier.

Reproduce

  1. Create a new Standard Front Door and CDN profiles and specify:
  • Azure Front Door offering
  • Quick Create option
  1. On the Create a Front Door profile page, populate the required fields:
    Azure Subscription / Resource Group / Resource Group Location / Name
  • Fill these values to suit your environment
    Profile Details:
    • Tier: Standard
      Endpoint Settings
  • Endpoint name: www-example-com
  • Origin Type: Custom
  • Origin host name: 1.1.1.1
  • Caching: disabled
  • Waf policy: blank
  1. Create a new CNAME record in your DNS provider with these values:
  • Name: www
  • Zone: example.com
  • Value: www-example-com-00000000000001.z01.azurefd.net
  • TTL 3600
  1. Create a new json file on your computer called records.json
  2. Populate the records.json file with content containing your public DNS records as follows, then save the file:
[
  {
    "CNAME": "www",
    "FQDN": "www-example-com-00000000000001.z01.azurefd.net",
    "ZoneName": "example.com",
    "ResourceGroup": null,
    "resourceProvider": null
  }
]
  1. Invoke the Dangling DNS finder tool:
Get-DanglingDnsRecords -InputFileDnsRecords ./records.json

Expected behavior
As we have created an endpoint (named www-example-com) against an Azure Standard Frontdoor within our Azure subscripion, we expect the tool to not identify any Dangling DNS records for Azure Frontdoor

AzureResourceProviderName AzureResourceCount AzureCNameMatchingResources AzureCNameMissingResources                     
------------------------- ------------------ --------------------------- --------------------------                     
Azure API Management                       0                           0                          0                     
Azure Container Instance                   0                           0                          0                     
Azure CDN                                  0                           0                          0                     
Azure Front Door                           0                           1                          0                     
Azure App Service                        111                           1                          0                     
Azure Blob Storage                       111                           0                          0                     
Azure Public IP addresses                  1                           0                          0                     
Azure Classic Cloud                        1                           0                          0                     
Azure Traffic Manager                      0                           0                          0

Screenshots
NA

Environment- if applicable

Python (Darwin) 3.10.8 (main, Oct 13 2022, 09:48:40) [Clang 14.0.0 (clang-1400.0.29.102)]

Desktop (please complete the following information if applicable):

  • OS: MacOS

Logs- if applicable

Additional context

tobystic commented

Thank you for submitting this issue and the accompanying PR. The team has been notified of these requests and you should get a response within the next 5 days

tobystic commented

@lawrencewilson can this be closed now?

  • 👍1