Subdomain Takeover: Resolving Dangling CNAME Records

A Subdomain Takeover is a security vulnerability that occurs when a subdomain (e.g. test.startup.com) points to an external service provider (like GitHub Pages, Zendesk, or AWS S3) that has been decommissioned or deleted, but the DNS CNAME record remains active.

---

How Takeovers Occur

An attacker discovers a CNAME record pointing to a deleted S3 bucket:

sub.startup.com CNAME startup-bucket.s3.amazonaws.com

Because the bucket is deleted, the attacker registers a new AWS S3 bucket named startup-bucket in their own account. The domain sub.startup.com now renders the attacker's bucket content directly, allowing them to host phishing pages or steal session cookies.

---

Mitigation & Auditing

• Audit CNAME records regularly: Scan all DNS configurations monthly using tools like Subfinder or Amass to detect dangling pointers.
• Delete CNAME records immediately: When deprecating SaaS services or deleting cloud resources, delete the corresponding CNAME record from your DNS registrar before deleting the resource.