Subdomain Takeover
Subdomain takeover occurs when a DNS record points to a decommissioned service (expired cloud host, deleted GitHub Pages, etc.). An attacker can claim the abandoned resource and serve content under the organization's domain.
Overview
Subdomain takeover happens when a subdomain's DNS record (typically a CNAME) points to an external service that no longer exists. Common targets include decommissioned GitHub Pages, Heroku apps, AWS S3 buckets, and Azure services. Attackers claim the abandoned service and gain control over the subdomain, inheriting the trust of the parent domain.
Impact
Phishing under trusted domain, cookie theft, credential harvesting, reputation damage, email interception.
Examples
Dangling CNAME
blog.example.com CNAME old-app.herokuapp.com (old-app.herokuapp.com is available for registration)
Remediation
Audit DNS records regularly, remove dangling CNAME entries, implement monitoring for subdomain status, use domain verification on cloud services.
Regularly audit all DNS records for dangling entries
Remove CNAME records when decommissioning services
Implement automated subdomain monitoring
Verify domain ownership on all cloud service providers
Use CAA DNS records to restrict certificate issuance
Related SuperClue scanner checks
These scanner checks look for signs of Subdomain Takeover. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works