Somewhere in your DNS settings there is probably a record pointing to a service you stopped using months ago: an old landing page builder, a demo on a cloud platform, a marketing tool you tried once. If that service is gone but the DNS record is not, you have a dangling record, and it is a real way to lose control of a subdomain.
What subdomain takeover actually is
OWASP's Subdomain Takeover Prevention Cheat Sheet defines it plainly: "Subdomain takeover is a vulnerability that occurs when a DNS record (typically a CNAME) points to a cloud resource or third-party service that has been deprovisioned or no longer exists." Anyone who notices the dangling record can claim that same resource on the third-party service and serve their own content from your subdomain, with your domain's trust attached to it.
This is not a rare edge case
Security firm SentinelOne reported flagging more than 1,250 subdomain takeover risks tied to dangling DNS for its clients in 2024 alone. Separately, researchers at Silent Push, in their "Danglegeddon" research, identified around 16,000 dangling subdomains and successfully simulated takeovers of roughly 4,000 of them.
What it gets used for
A hijacked subdomain on your own domain can host phishing pages, serve malware, or send email that looks legitimate because it comes from your real DNS, not a lookalike one. It also inherits whatever SEO trust and cookies your domain already carries, and it will not trip a browser warning the way a lookalike domain might.
A basic check
- Export your full DNS zone file, not just the records you remember setting up.
- For every CNAME pointing at a third-party platform, confirm that service is still active and still yours.
- Delete records for anything you decommissioned instead of leaving them in place "just in case".
Run a free AuditMerlin scan on each subdomain you still use to check its security posture (headers, HTTPS, exposed files) while you are auditing the DNS zone.