← All checks

Dangling CNAME and subdomain takeover: how to find and remove them

Dangling CNAME records high DNS · 6 of 100 points

What it inspects

A fixed list of common subdomains (www, mail, autodiscover, mta-sts, blog, shop, status, docs, cdn and others), plus every hostname in your MX, SPF and DMARC records, up to 40 names. Each CNAME found is followed; if its target does not exist (NXDOMAIN) it is reported, with a takeover warning when the target is on a service known for it (S3, GitHub Pages, Heroku, Azure and similar). Verdicts: PASS when none are dangling; FAIL when any is; SKIP when every CNAME lookup fails. There is no WARN, and this scanner does not fetch third-party pages to fingerprint takeovers.

Why it matters

If a CNAME points at a service name you released, someone else can register that name and serve content or receive mail on your subdomain, with your domain's cookies and reputation.

How to verify by hand

# bash
dig +short CNAME blog.example.com

# PowerShell
Resolve-DnsName -Name blog.example.com -Type CNAME

# does the target exist? NXDOMAIN means the CNAME is dangling
# bash
dig +short A old-site.provider.example

# PowerShell
Resolve-DnsName -Name old-site.provider.example -Type A

How to fix

Delete each dangling CNAME, or re-create the service it points at under your control.

  1. Delete the record at your DNS host if the service is gone.

  2. If you still need the name, re-create the resource at the provider first, then keep the CNAME.

  3. Remove DNS records in the same change that decommissions a service.

References

Scan your domain free