What Is a Subdomain Takeover?
A subdomain takeover lets an attacker claim one of your subdomains that points to a service you no
longer use. The DNS record still says blog.example.com → someprovider, but you closed that
provider account — so the attacker opens it under the same name and now serves content from your
subdomain. They inherit its trust: cookies, allowlists, and your brand’s credibility.
How does it happen?#
The root cause is a dangling DNS record — a pointer that outlived its target:
- You set
docs.example.comas aCNAMEto a cloud host or SaaS. - Later you delete the cloud resource but forget the DNS record.
- The record now points to an unclaimed name on that provider.
- An attacker registers that name, and controls
docs.example.com.
The subdomain resolves and works — it just serves the attacker’s content now. Because it is genuinely your domain, browsers, users, and even some security controls trust it.
Why is it dangerous?#
| Inherited trust | Abuse |
|---|---|
| Your brand and domain | Convincing phishing |
| Cookies scoped to the domain | Session theft in some setups |
| CORS / allowlist entries | Bypass origin-based controls |
| Reputation | Malware hosting under a trusted name |
How do you prevent it?#
- Inventory DNS records and the services they point to.
- Remove the DNS record first, before decommissioning the underlying service.
- Scan periodically for records resolving to unclaimed or dangling targets.
Subdomain takeover is an attack-surface and DNS hygiene failure. More at the Web Security hub.
Frequently asked questions#
What is a subdomain takeover?
A subdomain takeover happens when a subdomain’s DNS record points to an external service (a cloud host, CDN, or SaaS) that has been decommissioned, leaving the record "dangling." An attacker registers that service under the same name, and now controls content served from your subdomain — inheriting its trust, cookies, and reputation.
How do you prevent subdomain takeovers?
Maintain an accurate inventory of DNS records and the services they point to, and remove DNS entries as soon as the underlying service is decommissioned — before releasing the service name. Periodically scan for dangling records that resolve to unclaimed services. The root cause is DNS records outliving what they point to.