CanuteTheGreat/dns-hygiene-checker
Watch
1
0
Fork
You've already forked dns-hygiene-checker
 0
Code Issues Pull requests Projects Releases 4 Packages Wiki Activity Actions
4 releases 6 tags
  • v1.3.1 02baefb6bd

    dns-hygiene-checker v1.3.1
    All checks were successful
    tests / test (3.7) (push) Successful in 21s
    Details
    tests / test (3.14) (push) Successful in 27s
    Details
    release / release (push) Successful in 33s
    Details
    Stable

    CanuteTheGreat released this 2026-11-06 09:00:54 -08:00 | 5 commits to master since this release

    • The "possibly claimable" finding (GitHub Pages, Vercel, Netlify, Pantheon) now says what the unclaimed
      page does and doesn't show: Not published; may still be unclaimable if the domain is verified: the unclaimed page looks the same either way. A verified GitHub Pages domain still returns the 404 while
      other accounts can't publish to it, so the 404 alone is never a takeover verdict. Only added when the
      page was actually seen, not when the target doesn't resolve. Verdicts and exit codes are unchanged.
    • Provider docs re-checked 2026-11-06.
    • Tests: the caveat for every provider that supports domain verification, absence for those that don't,
      and the verified-domain cases (Vercel _vercel TXT, Azure asuid TXT) staying INFO.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker.git@v1.3.1
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.3.1/dns_hygiene_checker-1.3.1-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.3.1/dns_hygiene_checker.py

    SHA-256

    58440bfd3773ea1a0aac2bd8d9e6a8fa3a64ef6cfca92f8f72f10df3e67dd7f9  dns_hygiene_checker.py
f61d7e09b8f2602cf61ca9b85c4746e11981eda198490bc2ccb86065f9b793b7  dns_hygiene_checker-1.3.1-py3-none-any.whl
a129c860b6e6653d76af5c1fd2d95085c03ba5bf93f54b34ba311bd5b25a7750  dns_hygiene_checker-1.3.1.tar.gz
    Downloads
  • v1.3.0 b539ca50de

    dns-hygiene-checker v1.3.0
    All checks were successful
    tests / test (3.7) (push) Successful in 34s
    Details
    tests / test (3.14) (push) Successful in 1m0s
    Details
    release / release (push) Successful in 1m1s
    Details
    Stable

    CanuteTheGreat released this 2026-10-28 22:28:23 -07:00 | 6 commits to master since this release

    • An "unclaimed" page is no longer always reported as claimable. GitHub Pages, Vercel, Netlify, Azure App
      Service and Pantheon let the domain's owner verify the domain, after which other accounts can't attach it,
      so the same page is a real takeover risk on one domain and not on another. Those hosts now get
      WARN possibly claimable: <provider> blocks takeover if the domain is verified with <mechanism>; check your account. Azure's asuid.<host> TXT and Vercel's _vercel.<domain> TXT are looked up (found: INFO; Azure
      missing: FAIL). GitHub's TXT name contains the account name, so it can't be checked from DNS. Hosts whose
      docs describe no such check (Heroku, S3, Surge, Read the Docs, Ghost(Pro), ...) stay FAIL, now worded
      "claimable". Thanks to a reader for the correction.
    • Tests: one end-to-end test per provider class.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker.git@v1.3.0
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.3.0/dns_hygiene_checker-1.3.0-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.3.0/dns_hygiene_checker.py

    SHA-256

    17077c6eb8f7e2e595bd159c2a03e78096f7234f14c31757ffc77da3a2e5ee39  dns_hygiene_checker.py
342a99a4a79fa20b85935cb655021cc9adddbd92b9a586f72bbe29c8380be006  dns_hygiene_checker-1.3.0-py3-none-any.whl
60d262f6ab491b63b6d49e4b04241ba7a04d4263483005fde7c6aa1c0afd43e1  dns_hygiene_checker-1.3.0.tar.gz
    Downloads
  • v1.2.1 5c4d457736

    dns-hygiene-checker v1.2.1
    Some checks failed
    tests / test (3.14) (push) Has been cancelled
    Details
    tests / test (3.7) (push) Has been cancelled
    Details
    release / release (push) Successful in 14s
    Details
    Stable

    Ghost released this 2026-10-17 01:50:02 -07:00 | 18 commits to master since this release

    • Takeover verdicts follow can-i-take-over-xyz: a dangling CNAME to a service that verifies domain
      ownership before attaching a custom domain (CloudFront, Fastly, Firebase, Fly.io, Statuspage, Zendesk,
      WP Engine, Unbounce, UserVoice, Kinsta, Freshdesk) is a WARN, not a FAIL "takeover"; claimable
      suffixes match on label boundaries (x.mygithub.io no longer counts as GitHub Pages).
    • Tests: accuracy suite against that list, mutation testing (nightly), claims ledger.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker.git@v1.2.1
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.2.1/dns_hygiene_checker-1.2.1-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.2.1/dns_hygiene_checker.py

    SHA-256

    3d46acfa25b3618388515d2b1bd989abb96816496e8806ef264034c53d155f1c  dns_hygiene_checker.py
82b2840056d0089fb5f47e8ac7980d932e823933619066617ca036fc84751b55  dns_hygiene_checker-1.2.1-py3-none-any.whl
ae373133b3b7bf9bf37adcb0d99b7f0e217629f831f8fe12bc8b2c2de5aa4f88  dns_hygiene_checker-1.2.1.tar.gz
    Downloads
  • v1.2.0 53aeebba2d

    dns-hygiene-checker v1.2.0
    All checks were successful
    tests / test (3.13) (push) Successful in 41s
    Details
    tests / test (3.7) (push) Successful in 41s
    Details
    release / release (push) Successful in 28s
    Details
    Stable

    Ghost released this 2026-10-16 19:57:46 -07:00 | 23 commits to master since this release

    • Subdomain discovery: --ct (Certificate Transparency via crt.sh, Cert Spotter fallback), --zone-file
      (BIND zone files / exports) and --cloudflare (every record in the Cloudflare zone); --only-discovered.
    • Dangling NS delegations (FAIL when no nameserver resolves), dangling MX and SRV targets.
    • CAA and DNSSEC checks at the apex (--no-apex-checks to skip).
    • About 65 claimable hostname patterns (was ~25) and ~30 unclaimed-page fingerprints (was 14).
    • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker.git
      puts a dns-hygiene-checker command on PATH (pyproject.toml, MIT license metadata).
    • --version flag.
    • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
    • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
    • CI installs the package with pip in a clean venv and checks --version/--help on every push.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker.git@v1.2.0
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.2.0/dns_hygiene_checker-1.2.0-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/dns-hygiene-checker/releases/download/v1.2.0/dns_hygiene_checker.py

    SHA-256

    4f2c1ac98d5a938c9f62b9042362f7c68ac812049b4afe5abf201767439a382c  dns_hygiene_checker.py
0960eff48ad534c5fae6f71a95ec5438fe93b2feb38c57047619e03572c2d693  dns_hygiene_checker-1.2.0-py3-none-any.whl
afef21d9afd3ed05fcec75fcd2bdcfe904809c653031b464150e34af0dd19bfd  dns_hygiene_checker-1.2.0.tar.gz
    Downloads