← Glossary

Network & Infrastructure

Subdomain Takeover

Also: dangling DNS · dangling CNAME · subdomain hijacking · subdomain hijack

Last reviewed:

In one sentence

A subdomain takeover happens when a DNS record — usually a CNAME — still points at a third-party service that is no longer claimed, letting anyone sign up for that service and serve their own content under your legitimate subdomain.

Why it matters

This is a recurring, high-value bug-bounty finding precisely because it is easy to miss: the DNS record was correct when it was set up, and nobody removes it when the underlying service — a staging site on a hosting platform, a marketing landing-page builder, a storage bucket, a status page — gets decommissioned. An attacker who claims it gets a page served under your real domain, with a valid certificate they can obtain themselves: useful for phishing that passes every "check the domain" instinct, for harvesting cookies scoped to the parent domain, for bypassing a CSP that allow-lists *.example.com, and for plain reputational damage.

How it happens

promo.example.com.   CNAME   example-promo.pages.hosting-platform.example.
                             ↳ project deleted on the platform two years ago
                             ↳ anyone can now create "example-promo" there

The vulnerable pattern needs two things: a record that delegates the name to a provider (CNAME most often, but also NS delegation, A records to a released cloud IP, or MX to a decommissioned mail service), and a provider that lets a new customer claim an arbitrary name without proving ownership of the domain that points at it. Which providers allow that changes constantly; the community list (can-i-take-over-xyz) tracks it. A dangling name usually answers with a distinctive "not found" page or an NXDOMAIN on the target — the fingerprint scanners look for.

The fix is boring and permanent: remove the record when the service goes, or re-claim the resource. The prevention is a process: DNS changes go through the same decommissioning checklist as the services they point at.

Try it yourself hands-on

Auditing your domain's subdomains for stale pointers:

  1. List what exists. The DNS Mapper discovers subdomains and draws the records as a graph, which makes the delegations to third parties visible at a glance; for a single name, the DNS Record Lookup shows the CNAME chain and its TTL.
  2. Run the candidates through the Subdomain Takeover Checker. It resolves each name, follows the CNAME to its target, matches the target against 20+ services known to allow this pattern, and checks the response fingerprint for the "unclaimed" signature. A hit is a name an attacker could claim today.
  3. For anything flagged: remove the stale DNS record if the service is genuinely gone (the usual case), or re-claim the resource on the platform if it is still meant to exist. Then re-run the check to confirm the fingerprint no longer matches.
  4. Make it recurring, not a one-time audit — subdomains get decommissioned continuously as projects wind down, and this is exactly the kind of finding that accumulates silently. Put the check next to certificate-expiry monitoring, which already has a schedule.

Common misreadings

  • Wildcards make it worse. *.example.com CNAME platform means every unclaimed name under the wildcard is claimable.
  • NXDOMAIN on the target is not a fix. The record is still dangling; the day the provider reuses the name, the takeover is live.
  • Cookie scope. If your session cookie is set on .example.com, any taken-over subdomain receives it. Scope cookies to the host that needs them.