How it happens
- A CNAME points blog.example.com to a hosting project that was later deleted.
- The provider lets a new customer register the same project name.
- The new owner now serves pages, or sets cookies, on your subdomain.
Audit your zone
- Export all DNS records for your domain.
- For each CNAME, open the target. An error such as 'no such app' or 'not found' from the provider is a warning sign.
- Remove records for staging, preview and trial services you no longer run.
Prevent it
- Delete the DNS record first, then the service.
- Keep an inventory of subdomains and owners.
- Prefer scoped cookies so a takeover cannot read your main session. The __Host- cookie prefix helps.
Frequently asked questions
Does this affect A records too?
Yes, if an IP address you released is reassigned to someone else, but CNAMEs to third-party services are the most common case.