Subdomain takeover: a dangling DNS record an attacker can claim
If a subdomain still points (CNAME) at a deprovisioned host, someone else can register that host and serve content from your domain. Here is how to find and fix it.
A subdomain takeover happens when a DNS record — usually a CNAME — still points at a third-party service you no longer use. If that service lets anyone claim the unclaimed hostname, an attacker can host their own content on your subdomain.
Why it's serious
An attacker controlling app.yourdomain.com can run phishing under your brand, steal cookies scoped to your domain, or pass domain-validated checks. It looks legitimate because it really is your subdomain.
The fix
- Find DNS records pointing at services you no longer have an active resource on.
- Delete the dangling record in your DNS provider, or re-claim the resource on the target service.
- Audit wildcard and old marketing/staging subdomains — they're the usual culprits.
FAQ
What causes a subdomain takeover?
A DNS record (often a CNAME) that still points at a third-party host you deprovisioned. If the host lets anyone claim that unclaimed name, an attacker can serve content from your subdomain.
How do I fix a dangling DNS record?
Delete the record in your DNS provider, or re-claim the resource on the target service. Pay special attention to old staging, marketing, and wildcard subdomains.
Related questions
- Debug artifacts, risky TODOs, and leaked AI prompts in your build
- TLS and email checks: weak HTTPS and a spoofable domain
- Sensitive data shipped to the browser: config, internal fields, and bulk PII
- An outdated frontend library with a known vulnerability