Departed vendor still has records in our zone, nobody knows if any are still in use

TXT verifications, CNAMEs for SaaS tools and old DKIM keys often linger after a vendor switch. Harmless until they are not: a forgotten CNAME to an expired Heroku app or S3 bucket is direct takeover material.

Try this first

1. 1List departed vendors by category (mail tool, marketing, helpdesk, analytics) and look up their verification patterns.
2. 2Filter the zone for CNAMEs and TXT records that reference those vendors, plus old DKIM selectors no longer in use.
3. 3Check each CNAME target: is it alive, who owns it? CNAME to e.g. heroku-app.herokudns.com where the app is gone = takeover risk.
4. 4Remove or set TTL 60 with a 30-day observation window, watch for complaints.
5. 5Log in your DNS changelog who removed what when, so you can trace back if something does break.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.