Akamai DNS
Overview
The Akamai DNS integration connects the Praetorian Guard Platform (PGP) with your Akamai Edge DNS service, importing DNS zones and records directly into your attack surface. DNS records are foundational to attack surface discovery — every A, AAAA, CNAME, and MX record points to infrastructure that needs to be inventoried, monitored, and tested. PGP imports these records as seeds and assets, feeding them into the Guard discovery and scanning pipeline automatically.
This integration is ideal for organizations using Akamai Edge DNS who want to ensure that every DNS record is accounted for in their security program. It enables detection of dangling DNS records, subdomain takeover risks, and forgotten infrastructure — common attack vectors that arise when DNS records outlive the resources they point to.
What the Integration Does
When connected, PGP performs a read-only import from the Akamai Edge DNS API:
DNS Zones as Assets: Each DNS zone managed in Akamai Edge DNS is imported as a PGP asset, giving you an inventory of all authoritative zones under your control.
DNS Records as Seeds: Individual DNS records within each zone are imported as PGP seeds based on their type. A and AAAA records produce IP address seeds, CNAME records produce domain seeds, and MX records produce mail server seeds — all of which feed into continuous discovery and scanning.
Dangling Record Detection: By importing all DNS records, PGP can identify records that point to resources that no longer exist (e.g., decommissioned cloud instances, expired third-party services), which are prime candidates for subdomain takeover attacks.
Data flows one direction only — from Akamai Edge DNS into PGP. The integration never writes back to Akamai, modifies zones, or changes DNS records.
Prerequisites
Before setting up the integration, you need Akamai EdgeGrid API credentials:
Log in to [Akamai Control Center](https://control.akamai.com)
Navigate to Identity & Access Management under the account menu
Select the API Users tab
Click Create API Client (or select an existing user)
Under API Client Details, click Create Credential
Record the following values — they are only shown once:
Client Token
Client Secret
Access Token
API Host (e.g.,
akab-xxxxx.luna.akamaiapis.net)Ensure the API client has READ access to the DNS — Zone Record Management API
The API credentials must have read-only permissions to the Edge DNS API for the zones you want to import.
Setup
Go to Integrations, then Managed DNS, then Akamai DNS in the Guard Platform
Enter your EdgeGrid credentials in the setup form
Click Connect — PGP will validate your credentials by attempting to fetch your DNS zones before saving
If validation fails, verify that your API credentials have the correct permissions and that the API host does not include a protocol prefix.
What Data Is Synced
DNS Zones
Each Akamai Edge DNS zone creates an asset with:
Asset name: The zone name (e.g.,
example.com)Asset type: DNS zone
Metadata: Zone type (primary, secondary, alias), contract ID, and activation status
DNS Records
Records within each zone are imported as seeds based on record type:
Wildcard records (e.g., *.example.com) are imported as domain seeds to ensure wildcard-hosted subdomains are discoverable.
API Endpoints Used
Base URL: https://{your-api-host} (e.g., https://akab-xxxxx.luna.akamaiapis.net)
All requests are authenticated using Akamai EdgeGrid signing. The integration paginates through all zones and record sets in a single sync.
Troubleshooting
Security and Data Handling
Read-only access: The integration only reads data from Akamai Edge DNS. It never creates, modifies, or deletes zones or DNS records.
Credential handling: Your EdgeGrid credentials (Client Token, Client Secret, Access Token) are stored as encrypted credentials within PGP and are never exposed in logs or the UI after initial entry.
Authentication: Credentials are used to sign requests via the Akamai EdgeGrid authentication protocol over HTTPS.
Data filtering: Imported seeds and assets pass through PGP standard filtering rules, allowing you to control which zones and record types are included in your attack surface.