Glossary
SECURITY

Dangling CNAME

A CNAME record whose target no longer resolves or points to a resource you don't own. The technical name for the setup that enables subdomain takeover.

Dangling CNAME is the term for a CNAME record whose target hostname either doesn’t resolve at all or points to a third-party resource the current DNS owner no longer controls. It’s the precondition for a subdomain takeover.

Two Categories

  1. Abandoned target — CNAME points to myapp.herokuapp.com, but Heroku app was deleted. Attacker re-registers myapp, gets your subdomain’s traffic.
  2. Broken target — CNAME points to a hostname that returns NXDOMAIN. Depending on the service, an attacker may be able to register that hostname and claim the traffic.

Detection at Scale

  • Enumerate all subdomains via CT logs (e.g., crt.sh)
  • Resolve each — flag any that return NXDOMAIN or a service-specific “does not exist” response body
  • Report all CNAME chains that end in a third-party domain and confirm ownership of that endpoint

Fix

Periodic audits + a change-management rule: DNS records for third-party services get deleted as part of the service teardown, not after.

Read what a subdomain takeover is, check the subdomain takeover glossary entry, and the CNAME record entry.

← All terms Learning hub →