What is a Subdomain Takeover?

A subdomain takeover arises from a dangling DNS record. A company subdomain points to a cloud service, hosting platform or storage bucket whose resource has been deleted or released. If the provider lets another customer claim the same missing resource, an attacker can serve content under the trusted subdomain.

The impact depends on the subdomain and browser context. Attackers may host phishing pages, damage reputation or abuse cookies and trust relationships. A DNS record alone is not proof of exploitability: the referenced provider must actually allow the unclaimed resource to be registered.

How can companies prevent takeovers?

• - Remove or change DNS records before deleting the associated external resource.
• - Maintain ownership information for DNS records and review them continuously.
• - Verify findings with provider-specific behavior instead of relying only on a generic error signature.
• - Monitor new and forgotten subdomains as part of EASM.

DNS example: a dangling CNAME

campaign.example.com.  CNAME  old-project.hosting-provider.example.

If old-project is deleted at the provider while the CNAME remains, the subdomain still points to that platform. It becomes exploitable only if another customer can register the exact resource identifier and serve a valid response for it. DNS resolution or a provider-specific error page is therefore an indicator, not complete proof on its own.

Safer decommissioning sequence:

1. Check traffic and dependencies of the subdomain
2. Remove DNS or point it to a controlled destination
3. Wait for the DNS TTL and verify resolution
4. Only then delete the external resource
5. Update inventory, certificates and monitoring

How is a possible takeover verified?

Verification combines the DNS chain, provider fingerprint and actual registration behavior. It checks CNAME, A, AAAA and NS records, follows redirects and considers certificate issuance and HTTP responses. The foreign resource should not be registered without explicit permission because that could affect real visitors and process third-party data. A report can normally demonstrate reproducibly that the provider resource is available while the organization's DNS record remains active.

Why is asset management important here?

Takeovers often occur during migrations or after a project ends. DNS and the external service are managed in different places, so one side is removed while the other is forgotten. Clear ownership and decommissioning processes close that gap. Marketing campaigns, test environments and SaaS integrations are particularly relevant because they often live for less time than the centrally managed DNS zone.