Subdomain Takeovers Explained for Testers and Defenders

Subdomain takeover is DNS archaeology: `marketing.oldsaas.com` still points at a service nobody owns anymore, and someone else can claim it.

For testers, the win is proving claimability in scope—not actually sitting on the subdomain unless rules explicitly allow PoC hosting.

Takeover checks are cheap compared to incident response after a hijacked subdomain served malware. Testers should report dangling DNS with the same calm urgency as any critical finding.

How records go stale

Acquisitions, expired trials, deleted S3 buckets, and GitHub Pages projects that moved on. CNAME chains to third parties are frequent culprits.

Detection workflow

Enumerate subdomains, resolve, compare HTTP responses and fingerprint against known vulnerable patterns. Tools flag candidates; humans confirm ownership gaps.

• Check NS delegations and wildcard behavior

• Document the exact record and service

• Prefer vendor documentation links in reports

Defender fixes

Remove dangling records, reclaim the external resource, or repoint to a controlled sink. Monitor CT logs for new subs.

Takeovers range from informational to critical depending on cookie scope and phishing potential.

Follow program policy on PoC—many forbid actually registering the orphaned service.

Encourage clients to monitor vendor SaaS trials—takeovers often start when marketing experiments expire without DNS cleanup.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Verify dangling DNS with client DNS admins—false positives waste goodwill.

Claim proof without harm

Some programs accept DNS proof screenshots instead of live takeover—ask before claiming a service username.

Check cookie scope on parent domains; takeovers escalate when cookies are overly broad.

Monitoring for defenders

Recommend continuous subdomain monitoring plus CNAME expiry alerts—takeovers are time-sensitive.

Explain phishing angle to executives without fear hype—brand trust is the business hook.

Differentiate NXDOMAIN dangling CNAME from active misconfigurations still serving content.

---

Worth reading next

Recon Series: Subdomain Enumeration

Tools & Techniques: Amass for Asset Discovery

Information Disclosure: The Quiet Vulnerability Class