Subdomain Takeover
Subdomain takeover claims a dangling DNS record pointing at a released third-party resource — a deleted SaaS tenant, an unregistered bucket — and serves attacker content under your domain.
Definition
A subdomain takeover occurs when DNS or a CNAME points to an external service resource that no longer exists or is no longer owned. The resource identifier is claimable — often simply by signing up — so the attacker registers it and controls responses for your hostname. HTTPS with a wildcard or provider-issued certificate then makes the content indistinguishable from yours.
Context and scope
Results from expired SaaS trials, deleted cloud resources with retained DNS, and infrastructure migrations. Detected via DNS sweeps for CNAMEs resolving to claimable providers.
Common misconceptions
- Deleting the resource deletes the risk — the DNS record is the vulnerability; removing the resource leaves the dangling claim
- NXDOMAIN responses are harmless — some takeovers resolve fine; the CNAME target being unclaimed is the signal, not an error status
- Only the exact subdomain is affected — the parent domain reputation, cookies, and phishing trust are all borrowed by the takeover
Anti-patterns
- Expiring vendor trials while keeping the vanity CNAME live in DNS
- Provisioning customer subdomains to cloud storage without reclaiming DNS on deprovisioning
- Running ad hoc DNS without periodic dangling-record audits
Related concepts
Related examples
Authoritative source
https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers
What it is
A hostname is a pointer plus a target. When the target lapses but the pointer remains, whoever claims the target inherits the hostname. Users see the same domain, same padlock potentially, different owner.
How it works
The attacker enumerates CNAMEs pointing at service endpoints — GitHub Pages, Heroku, S3 website endpoints, helpdesk vendors — verifies the target is unclaimed, then registers it. Content served there carries your domain into phishing, cookie scoping on older browser behavior, and OAuth redirect whitelisting mistakes.
When to act
Decommissioning flows must remove DNS and provider resources atomically. Scheduled scans compare CNAME targets against claimable-resource fingerprints and alert on dangles before attackers find them.
Pitfalls
Certificates: providers auto-issue for claimed resources and CT logs reveal the takeover timeline. Some takeover types require specific responses and are provider-version dependent — automated fingerprint databases keep scans current. Customers sharded on your subdomains inherit the blast radius of each takeover.