A subdomain takeover occurs when a DNS record, usually a CNAME, still points to an external service resource that no longer exists, and an attacker registers that resource and so controls what your subdomain serves.
Why it matters
The attacker's content appears under your own domain, so it can host phishing pages, steal cookies scoped to the parent domain, bypass CSP allowlists that trust your subdomains, or damage your reputation and search rankings. It is common after a marketing site, trial or cloud service is shut down but the DNS entry is forgotten. The root cause is cleanup order: delete the DNS record first, then the service.
Example
promo.example.com. 300 IN CNAME example-promo.github.io.If the GitHub Pages site example-promo was deleted, the name may return a "There isn't a GitHub Pages site here" page, which signals that someone else could claim it. Check with dig promo.example.com CNAME and fetch the page. Whether a service is claimable varies by provider, so verify each one.
Common mistakes
- Deleting a cloud resource without removing its DNS record.
- Auditing only live sites and not the full DNS zone export.
- Ignoring NS delegations to a DNS service you no longer use, which can be just as dangerous.
- Using wildcard cookies and wildcard CORS or CSP rules that extend trust to every subdomain.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.