Subdomain takeover, explained: how a forgotten DNS record becomes someone else's website
A subdomain takeover occurs when an attacker gains control over a subdomain by pointing its DNS record to a service they control, after the original service (like a cloud storage bucket or a SaaS platform) has been abandoned. You are at risk if you have DNS records (like CNAMEs) pointing to external services that you no longer use or have improperly configured. The primary defense is a consistent process to remove DNS entries for decommissioned services and to ensure all external resources are actively claimed and secured.
How a takeover works
The Domain Name System (DNS) is the hierarchical system that translates human-friendly domain names to numeric IP addresses SOURCE 2. The subdomain now points to a destination that is unclaimed. An attacker can then register the abandoned resource at the same provider (e.g., create a bucket at yourcompany.exampleprovider.com) and fully control the content served at your subdomain.
The risks and impact
Once controlled, the subdomain can be used for phishing, serving malware, or stealing user cookies and session data from your main domain. Because the subdomain is a legitimate part of your organization's domain, security warnings for users are minimal. This type of misconfiguration is recognized as a critical security risk in widely adopted standards like the OWASP Top Ten, which serves as a standard awareness document for the most critical web application security risks SOURCE 1. The impact extends beyond reputation.
How to know if you're at risk
For each record, verify that the target service is still in use and that you maintain administrative control over it.
Prevention and remediation
Prevention is straightforward but requires consistent process. Use monitoring to alert on changes to where your subdomains resolve.
Frequently asked questions
What's the difference between a subdomain and a domain?
A domain is the primary address for your organization (e.g., example.com). A subdomain is a prefix added to the domain to create a separate address (e.g., docs.example.com).
Can an A record be used for a takeover?
Is this only a problem for large companies?
It is a fundamental configuration issue, not a scale issue.
How is this related to the OWASP Top Ten?
What's the first step to check my exposure?
Then, audit each record pointing to a third-party service.
Where to start
Sources
---
_Researched with AI assistance from a live passive security scan run by NEL (scan eph_mt8bvq6h_1sa1), which was not retained; citing 2 external sources; 3 factual claims were extracted and checked against their sources (2 of 3 verified); each verification step was independently recorded and signed by Vitna, which attests that the check ran and what its verdict was — not that the underlying claim is true (records b631aa44-7ef8-4c3e-a99e-ee9aec7e263f, c1499aca-0e34-4ff3-8b14-40e55189f9eb, dba8e17f-b2a1-48f1-87f4-5206bdb2892f, +38 more, verify at https://vitna.costrinity.xyz/api/evidence/verify); reviewed and approved by admin:nelnationale before publishing; published by NEL Professionals with no individual byline._
Get up to 100 scans or unlimited lifetime access starting at $15.
View Plans →Comments (0)
No comments yet. Be the first to comment!