A safe checklist for reducing subdomain takeover risk.
Subdomain takeover risk can occur when a DNS record points to a third-party service that is no longer claimed by the organization. If the provider makes that resource claimable, an attacker may be able to serve content from a trusted-looking subdomain.
1.Find likely orphaned records
Review CNAME records that point to decommissioned SaaS, hosting, PaaS or CDN resources. Compare DNS records with current cloud and application ownership. Certificate transparency and historical inventory can help identify forgotten subdomains.
2.Validate ownership safely
Confirm whether the destination is unclaimed and whether your organization still needs the DNS record. Do not attempt to claim third-party resources outside an explicit authorized process.
3.Remediate decisively
Remove unused DNS records. If the service is still required, ensure the correct account owns and configures the destination. Add an ownership review to decommissioning and vendor-offboarding workflows.
4.Monitor for recurrence
Watch for new subdomains, DNS changes and certificates issued for unexpected names. The risk is operational: it returns when teams create and abandon services without clearing their DNS.