04 Nov 2026
A subdomain takeover happens when one of your subdomains still points to a cloud service you deleted. An attacker claims that same service name, and suddenly they control content on your subdomain, with your brand and your cookies' trust.
The cause is almost always a dangling DNS record: a CNAME or other record left behind after a resource was removed. Here is how to find them and stop them for good.
The attacker never touches your DNS. Your own record sends visitors to them.
| Service type | Example record target | Typical cause |
|---|---|---|
| Cloud web apps | yourapp.azurewebsites.net | App deleted, CNAME kept |
| Object storage sites | bucket name on a storage website endpoint | Bucket removed |
| Hosted pages | yourorg.github.io | Repo or Pages site removed |
| SaaS landing pages and help desks | custom domain on a SaaS provider | Subscription cancelled |
| CDN endpoints | custom endpoint on a CDN | Endpoint deleted |
Teams creating subdomains outside central IT make this worse. See shadow IT domains.
Your security team or a VAPT engagement can include this as a standard check.
| Rule | How to apply it |
|---|---|
| Delete DNS before the resource | Make DNS removal step one in any decommission checklist |
| Own the inventory | Every subdomain has an owner and purpose |
| Control who creates records | Roles and approvals on DNS changes |
| Automate checks | Scheduled scans for dangling targets |
| Use provider verification | Turn on domain verification features where the cloud provider offers them |
Managing many zones? Read subdomain management and consider premium cloud DNS with change control.
Client: B2B SaaS company, Bengaluru
Challenge: Product, demo and test subdomains had been created by several teams. Some pointed to deleted cloud apps.
What we did: Zone export, target checks, deletion of 14 dangling records, approval workflow for new DNS records, monthly automated scan.
Results:
Client: Global capability centre, Hyderabad
Challenge: Marketing pilots left dozens of campaign subdomains pointing at expired SaaS landing pages.
What we did: Inventory with owners, removal of unused records, decommission checklist added to the marketing tool process.
Results:
Subdomain takeovers are easy to prevent once you know where to look. Delete DNS records before deleting resources, keep an inventory with owners, control who can add records and scan regularly.
Need help? Flying Stars reviews and secures DNS as part of domain protection services and DNS management services.
