VibeSecurity

Security check

Subdomain takeover: dangling DNS records to clean up

A subdomain takeover happens when your DNS still points to a hosting service you have deleted. Someone can claim that service name and serve their own content from your subdomain.

By the VibeSecurity team1 min read

How it happens

  • A CNAME points blog.example.com to a hosting project that was later deleted.
  • The provider lets a new customer register the same project name.
  • The new owner now serves pages, or sets cookies, on your subdomain.

Audit your zone

  • Export all DNS records for your domain.
  • For each CNAME, open the target. An error such as 'no such app' or 'not found' from the provider is a warning sign.
  • Remove records for staging, preview and trial services you no longer run.

Prevent it

  • Delete the DNS record first, then the service.
  • Keep an inventory of subdomains and owners.
  • Prefer scoped cookies so a takeover cannot read your main session. The __Host- cookie prefix helps.

Frequently asked questions

Does this affect A records too?

Yes, if an IP address you released is reassigned to someone else, but CNAMEs to third-party services are the most common case.

Sources

  1. 1.MDN: Subdomain takeovers