Subdomain Takeover Risk (Dangling DNS)
DNS records point at deactivated third-party services (cloud apps, shops, helpdesks) that anyone can re-register and take over.
What is Subdomain Takeover Risk (Dangling DNS)?
When a team retires a SaaS service — a Heroku app, a Shopify store, a GitHub Pages site, a Zendesk portal — but forgets to delete the DNS record pointing at it, the subdomain becomes "dangling". The DNS still resolves, but the target resource no longer belongs to you. Many providers allow anyone to claim that resource name on their platform; when an attacker does, your subdomain now serves content they control, protected by a valid certificate for YOUR domain. They can host phishing that shows your real domain in the address bar, set cookies that scope to your parent domain, and pass security tooling that trusts your domain.
Why It Matters to Your Business
A successful takeover gives an attacker a trusted, verified-HTTPS page on your own domain — the strongest possible phishing primitive. Cookies set on the subdomain can be scoped to affect sessions across related subdomains, enabling session-fixation attacks. Brands have had taken-over subdomains used for credential harvesting, malware distribution, and SEO spam, with the cleanup and reputational cost falling on the domain owner even though the failure was in a forgotten DNS record.
How to Fix It
1. Inventory: export ALL DNS records (A, AAAA, CNAME) from every zone you own, including parked domains. 2. For every record pointing at a third-party service, verify the service still exists and is yours: - Heroku: the app must exist in your dashboard - GitHub Pages: repo + pages enabled - Shopify/Zendesk/Front: store/portal active under your account 3. Delete every DNS record whose target no longer exists. Deleting the service is not enough — the DNS record is the vulnerability. 4. Set a policy: DNS cleanup is part of service decommissioning, in the same checklist. 5. Monitor continuously: our subdomain takeover scanner checks all your resolved names against the known takeover fingerprint database on every scan — dangling records are reported before someone else finds them.
Frequently Asked Questions
How does a subdomain takeover actually work?
Your DNS points help.yoursite.com at a third-party service. You delete the service but keep the DNS record. The attacker creates a new account on that service with the same name, verifies nothing (some providers), and now help.yoursite.com serves their content with a valid certificate for your domain.
We shut down the service months ago — is the DNS record also gone?
Almost never, and that is exactly the problem. DNS records routinely outlive the services they pointed at. Unless someone explicitly deleted the record, assume it is still there and still resolving.
How can I check if my domain has dangling records?
Run a free scan on this page — our subdomain enumeration and takeover scanners resolve every name under your domain and match each against known takeover signatures.
Technical Classification
| OWASP Category | A05:2021 — Security Misconfiguration |
| CWE ID | CWE-284: Improper Access Control |
| Detected By | subdomain_takeover, subdomain_deep scanner(s) |
| Severity Level | high |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our subdomain_takeover, subdomain_deep scanner checks for this issue automatically.
Scan My Website FreeRelated Vulnerabilities
Exposed Service Port
A sensitive service port (MySQL, Redis, RDP, SSH, MongoDB) is exposed to the public internet.
No Web Application Firewall (WAF)
No Web Application Firewall is detected, leaving the site exposed to SQL injection, XSS, and bot attacks.
Exposed Admin Panel (Login Interface)
Administrative interfaces (wp-admin, phpMyAdmin, cPanel) are internet-reachable, inviting brute force and exploitation.