Subdomain takeover is one of the more elegant attacks, in the sense that it requires no compromise at all. It exploits ordinary administrative untidiness: a DNS record left pointing at a service you no longer use.
The mechanism
You point status.yourcompany.com at a hosted service via a CNAME. Later you stop using that service and cancel the account, but the DNS record remains. The hosting provider frees the name. An attacker registers it on that platform, and now controls content served at a genuine subdomain of your domain — with a valid TLS certificate, because they legitimately control the name.
Why it matters more than it sounds
- Phishing from a real subdomain of your brand, which passes every check a careful user makes.
- Cookies scoped to your parent domain may be readable, depending on how they were set.
- Reputational damage from arbitrary content published under your name.
- Bypassing allow-lists in partners' systems that trust your domain.
Finding dangling records
Export your full DNS zone and check every CNAME and A record: does the target still exist, and do you still control the account behind it? Pay particular attention to records pointing at cloud platforms, CDNs, documentation sites, status pages, help desks, marketing tools, and anything from a campaign or project that ended.
The prevention is procedural
Make DNS record removal part of cancelling any service. When a vendor relationship ends, the checklist should include the DNS entry alongside revoking access and rotating credentials. Most takeovers trace to a cancellation that handled billing and access correctly and forgot the record.
If you find one already taken
Remove the DNS record immediately, which ends the association. Check whether cookies or trust relationships scoped to your domain were exposed, review what content was served and for how long, and consider whether customers may have encountered it. Then audit the rest of the zone, because organisations that have one dangling record usually have several.