Subdomain takeover: the forgotten DNS record that becomes a risk
A subdomain still pointed at a cancelled service can be claimed by anyone. How the takeover works and the quarterly check that prevents it.
The short answer
Years ago someone set up a subdomain of your company for a campaign page, a support portal, a status page or a marketing tool, pointing a DNS record at that vendor’s service. Later the tool was cancelled. The DNS record was not. It still tells the world that your subdomain lives at that vendor, but nothing of yours is there anymore. An attacker signs up for the same vendor, claims the name your record points at, and from that moment serves whatever they like under a genuine subdomain of your business, with a valid certificate. That is a subdomain takeover, it is found by automated scanners within days, and it is prevented by a quarterly DNS review.
How it happens
- A subdomain is created and pointed at an external service: a hosted page builder, a support desk, a status page, a cloud storage bucket, an email or marketing tool.
- The service is cancelled or the project ends. The account behind the name is deleted.
- The DNS record remains, pointing at the vendor, now at a name nobody holds.
- A scanner finds it: subdomains are enumerated from certificate logs and DNS data, and each is tested for the signature of an unclaimed service.
- The attacker claims the name at the vendor and receives every visitor to your subdomain.
What the attacker does with it
| Use | Effect |
|---|---|
| Phishing on a real subdomain | A login page at a genuine address of your company, with a valid certificate; very convincing |
| Malware distribution | Downloads from an address that passes as yours |
| Cookie attacks | In some configurations, reading or setting cookies for your main domain, attacking logged-in users |
| Email abuse | If mail-related records dangle, mail that authenticates as yours |
| Reputation damage | Your domain on blocklists; browser warnings on your subdomains; customers deceived under your name |
The quarterly review
Export the DNS zone. For every record that points outside your own platform, a CNAME to a vendor, an A record to an address you rented, an MX or TXT for a service, answer one question: do we still control the destination? If yes, note it and the owner. If no, delete the record. If unsure, delete it; a record nobody can explain is a record nobody needs. Then check the certificate transparency logs for your domain to see which subdomains exist that you did not know about, and repeat for those.
What this means for you
Every subdomain you ever pointed at a vendor is a promise that the vendor still hosts something of yours. When the vendor relationship ends, the promise becomes a gift to whoever claims the name. Put “delete the DNS record” at the end of every cancellation, review the zone quarterly, and delete anything nobody can explain. It is an hour a year against one of the easiest ways for an attacker to borrow your name.
Frequently asked questions
How would an attacker even know our old subdomain exists?
Automated scanners enumerate subdomains of every domain continuously, from certificate logs, DNS data and word lists, and test each for the signature of an unclaimed service. A dangling record is found within days of the service being cancelled, without anyone targeting you specifically.
What can they actually do with a subdomain of ours?
Host a convincing phishing page on a genuine subdomain of your company with a valid certificate; serve malware from a trusted-looking address; in some configurations, read or set cookies scoped to your main domain and attack logged-in users; and, if mail records are involved, send email that passes as yours. The damage is to your customers and your reputation.
We have dozens of DNS records. Where do we start?
Export the zone and go through every record that points outside your own infrastructure: CNAMEs to vendors, A records to addresses you no longer control, MX and TXT records for services you left. For each, either confirm the destination is still yours or delete the record. It takes an hour the first time and minutes every quarter after.
Sources
- OWASP Cheat Sheet Series: Subdomain Takeover Prevention (accessed 2026-09-11)