DomainAfterCare
← Back to Free Tools
FREE SUBDOMAIN VULNERABILITY AUDITOR

Subdomain Takeover Checker & Dangling DNS Scanner

Detect dangling DNS CNAME records pointing to abandoned cloud hosting services before hackers hijack your brand.

How Subdomain Takeover Detection Works

Performs a recursive CNAME lookup on the submitted subdomain. If pointing to known cloud hosting providers, the engine probes the target over HTTP/HTTPS and evaluates response bodies against canonical abandonment signatures (e.g. NoSuchBucket, 404: NOT_FOUND).

✓ Status: SECURE

The subdomain points directly to an active web server or resolves to an actively claimed cloud deployment with no orphan signatures detected.

✗ Status: VULNERABLE

Dangling DNS pointer detected. The underlying cloud project was deleted without cleaning up DNS. Immediate CNAME deletion required.

Frequently Asked Questions About Subdomain Takeovers

What is a subdomain takeover vulnerability?+
A subdomain takeover happens when a domain points via a DNS CNAME record to an external cloud service (e.g. AWS S3, GitHub Pages, Heroku, Shopify) that has been decommissioned or deleted without removing the DNS record. An attacker can register an account with that service, claim the abandoned name, and serve malicious content on your domain.
Which cloud hosting providers are vulnerable to dangling CNAME takeovers?+
Common services susceptible to dangling CNAME takeovers include AWS S3 buckets, GitHub Pages, Amazon CloudFront, Heroku, Microsoft Azure App Services, Ghost, Tumblr, Zendesk, and UserVoice.
How do I fix a vulnerable subdomain takeover immediately?+
The fastest remediation is to log in to your DNS provider (Cloudflare, Route 53, GoDaddy) and delete the orphaned CNAME record immediately. Alternatively, reclaim the exact bucket name or resource handle in the target cloud provider under your own organization.
Can attackers intercept authentication cookies with a hijacked subdomain?+
Yes! If your main web application sets session cookies with "Domain=.yourdomain.com", any compromised subdomain can access and exfiltrate those cookies, allowing attackers to hijack active user accounts.

Complementary Domain & Email Authentication Tools

Strengthen your client email infrastructure and DNS security perimeter with our free web tools.

🛡️

SPF Record Generator

Generate RFC 7208 compliant SPF TXT records with instant syntax validation.

Open Tool →
🧮

SPF Lookup Calculator & Flattener

Audit the 10-lookup limit and recursively inspect nested include: mechanisms.

Open Tool →
🎨

BIMI Checker & VMC Validator

Audit BIMI records, preview SVG logos, and check VMC certificate readiness.

Open Tool →
✉️

DMARC Policy Generator

Build custom p=reject or p=quarantine policies with aggregate reporting.

Open Tool →

Ready to Protect Your Client Portfolio?

Select an agency portfolio plan to start continuous Certificate Transparency monitoring, automated DMARC compliance, and white-label client reporting today.

View Plans →Contact Sales (Agency Fortress)