Subdomain Takeover (Subdomain Takeover)
Why Subdomain Takeover Matters
Subdomain takeover is a common vulnerability in organizations that use many external services. A typical scenario: a marketing team creates blog.example.com pointing to a hosted blog platform. Later they stop using the platform but do not remove the DNS record. An attacker signs up for the same platform, claims the abandoned endpoint, and now serves their content at blog.example.com.
The impact is severe because the attacker's content is served under your domain. They can set cookies for your parent domain (potentially hijacking sessions), host convincing phishing pages, distribute malware under your brand's trust, and damage your domain reputation.
Services commonly involved in subdomain takeover include AWS S3 buckets, Heroku apps, GitHub Pages, Azure services, Shopify, and various SaaS platforms. Prevention requires maintaining an inventory of all subdomains and their external service associations, and promptly removing DNS records when services are decommissioned.
Real-World Example
In 2020, security researchers identified over 670 Microsoft subdomains vulnerable to takeover due to dangling DNS records pointing to deprovisioned Azure services. Attackers could claim these subdomains and host malicious content under microsoft.com, bypassing cookie scoping and CSP policies that trusted the parent domain.
Checking Your Setup
A DNS health checker identifies CNAME records pointing to external services. Regularly audit these to verify the services are still active. If a CNAME points to an unclaimed service endpoint, either remove the DNS record or reclaim the endpoint.
Check DNS Health