What we check/DNS hygieneDN-05

Dangling subdomains

A subdomain pointing at a service that no longer exists can be claimed by somebody else.

Area

DNS hygiene

Check

DN-05

Included

Free in every scan

What we check

We check a short list of common subdomains, plus names found in certificate transparency logs, for a CNAME whose target does not resolve.

We only report a name when the answer is definitive. A timeout or a server failure is recorded as inconclusive, never as a finding.

Why it matters

If blog.yourcompany.com points at a hosting service you stopped paying for, whoever signs up for that name next controls a page on your domain — with your name in the address bar, your cookies in scope, and a valid certificate.

This is one of the most reliably exploited findings in the whole report, because it is easy to automate and easy to forget.

How to fix it

1. 1

   Delete the DNS record, or reclaim the target at the service it points to.

2. 2

   Do the deletion in that order — remove the DNS record first, so nobody can claim it while you decide.

3. 3

   Then look for the pattern rather than the instance: subdomains are usually abandoned in groups, when a service is dropped or a campaign ends.

Common questions

How would someone exploit this?

They sign up for the abandoned service and claim the name your CNAME points at. From then on they serve whatever they like on your subdomain.

Why did you only check a few subdomains?

There is no way to list a domain's subdomains. We probe common names and anything visible in certificate transparency logs, capped at 25.

You flagged a subdomain I think is fine.

Check it by hand with dig before assuming either way — but a CNAME to a name that returns NXDOMAIN is exactly the condition, and it is worth ten seconds to confirm.