In one sentence: A subdomain takeover happens when a company forgets to delete a web address that still points to a service it no longer uses, and an attacker claims that service and starts speaking in the company’s name.

What it is

A subdomain is a named part of your web address, such as shop.example.co.uk. Companies create them for campaigns, tools and test sites, often pointing them at an outside service using a DNS record called a CNAME (an alias).

When the outside service is switched off but the alias is left behind, the record is “dangling”. Microsoft describes this as a common, high-severity threat for organisations that regularly create and delete many resources. MITRE lists it too: subdomain hijacking can occur when organisations have DNS entries that point to non-existent or deprovisioned resources.

How it works

A generic example of the stages, based on Microsoft’s description:

1. Creation. A team sets up a cloud service and points `app.example.co.uk` at it with a CNAME record.
2. Deprovisioning. The cloud service is deleted. The CNAME is forgotten.
3. Discovery. An attacker finds the dangling name with commonly available methods and tools.
4. Takeover. The attacker creates a new resource under the same service name. Traffic for your subdomain now goes to them.
5. Abuse. They control the content on your subdomain.

Microsoft lists what that can lead to: loss of control of content and brand damage, cookie harvesting from visitors, phishing campaigns, and further attacks such as cross-site scripting and CORS bypass. It also points out that a hijacker can apply for and receive a valid TLS certificate for the hijacked name, so a padlock does not prove safety. Mail records can be abused in the same way.

Who it affects and how badly

• Sole trader to 10 staff: an old campaign or booking page alias. Worst case: a fake page on your own domain asking customers for card details.
• 10 to 50 staff: agencies, retailers and recruiters who set up many short-lived sites.
• 50 to 250 staff: SaaS start-ups and MSPs with many cloud resources created and deleted by different people.
• Regulated businesses and councils: a hijacked subdomain on a trusted domain can be used for phishing that looks official.

Real examples

• SubdoMailing, reported by Guardio Labs in 2024. Guardio describes the manipulation of thousands of hijacked subdomains belonging to or affiliated with big brands, used to send large volumes of spam and phishing emails. In one case an MSN subdomain still pointed at an outside domain from an old promotion. Guardio reports the domain was abandoned for about 21 years and re-registered in September 2022, after which its new owner controlled the DNS records and so the MSN subdomain’s record.

How to detect it

• List every DNS record in every zone you control and check that each target still exists and is yours. Microsoft provides a PowerShell tool, Get-DanglingDnsRecords, for Azure resources.
• Review CNAME, MX and SPF records for names that no longer resolve or domains that expired.
• Compare your cloud resource inventory with your DNS zone each time something is deleted.
• Watch for phishing reports that use your domain.

How to fix or prevent it

1. Delete the DNS record first when you retire a service. Make this a step on the shutdown checklist.
2. Create the DNS record only after the resource exists, and keep a note of who owns it.
3. Keep an inventory of subdomains, domains and the services behind them.
4. Remove unused addresses and domains from SPF records, and renew the domains you still need.
5. Where your DNS host supports it, use alias records tied to the underlying resource, so a deleted resource does not leave a live record behind (Microsoft).
6. Avoid sharing cookies across all subdomains unless needed, because any subdomain can read them (Microsoft).

Related terms

• port 53 dns
• how dns spoofing works
• phishing
• cross site scripting
• supply chain attack
• nmap

Frequently asked questions

What is a dangling DNS record?
Microsoft describes it as a DNS record that points to a deprovisioned resource. CNAME records are especially vulnerable.

Does a padlock on the site prove it is safe after a takeover?
No. Microsoft notes a threat actor can apply for and receive a valid TLS certificate for the hijacked subdomain.

How long can an abandoned record stay dangerous?
Guardio’s MSN example shows a domain abandoned for about 21 years being re-registered and then controlling a subdomain record.

Sources

• Microsoft Learn, prevent dangling DNS entries and avoid subdomain takeover: https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
• MITRE ATT&CK T1584.001 Compromise Infrastructure: Domains: https://attack.mitre.org/techniques/T1584/001/
• Guardio Labs: SubdoMailing report: https://guard.io/labs/subdomailing-thousands-of-hijacked-major-brand-subdomains-found-bombarding-users-with-millions

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.