Subdomain Takeover Checker
Find the CNAME that points somewhere nobody owns any more.
A subdomain takeover starts with an ordinary piece of housekeeping that never happened. Someone points blog.example.com at a hosting provider with a CNAME, the project is retired, the hosting account is deleted — and the DNS record stays. The name it points at is now free, and the provider will hand it to whoever asks for it next. That person then serves whatever they like from your hostname.
The consequences are worse than a defaced page. The hostname is inside your domain, so it inherits trust that a lookalike domain never gets: cookies scoped to the parent domain may be sent to it, OAuth redirect allowlists written as *.example.com may accept it, internal links point at it, and a certificate issued to the new owner produces a perfectly valid padlock. Phishing from a genuine subdomain of the target is materially more convincing than phishing from anywhere else.
Detection is a matter of asking two questions about every subdomain you have: does it delegate to a third party, and does that third party say the resource is unclaimed? This tool answers both for one hostname. The unglamorous fix is almost always the right one — delete the DNS record. While it exists, the name is claimable; once it is gone, there is nothing to take over.
What this tool does
Follows the whole chain
Walks the CNAME chain to its final target rather than stopping at the first hop, because that is where the dangling record usually sits.
Matches the service, not a 404
Looks for the specific unclaimed-resource response a provider returns. An ordinary 404 from a live site is not a takeover and is not reported as one.
Says what it can prove
The strongest verdict is "vulnerable", meaning every published precondition is present. Confirming a takeover means performing one, which we do not do.
Read-only
A DNS lookup and one HTTP request to the host you asked about. Nothing is registered, claimed or modified.
Frequently asked questions
What is a subdomain takeover?
It is what happens when a subdomain still has a DNS record pointing at a third-party service that no longer holds the underlying resource — a deleted app, a removed storage bucket, an unclaimed site. Because the provider will re-issue that name to whoever registers it next, an attacker can claim it and serve their own content from your hostname.
Why is this worse than a lookalike domain?
Because the hostname is genuinely yours. Cookies scoped to the parent domain can be sent to it, OAuth and CORS rules written with a wildcard may accept it, and the attacker can obtain a valid certificate for it. A visitor checking the address bar and the padlock sees nothing wrong.
Does a 404 mean my subdomain can be taken over?
No, and treating it that way is the most common false positive. A live service returning 404 for a missing page is completely normal. A takeover is only indicated when the provider returns its specific unclaimed-resource response — a different page with different wording, which is what this tool matches on.
Does this prove a takeover is possible?
No. Proving it would mean actually registering the dangling resource, which is the attack itself. The strongest thing this reports is that every documented precondition is present. That is enough to act on: the fix is to remove the record either way.
How do I fix a dangling record?
Delete the DNS record, or re-claim the resource it points at. Deleting is usually correct and always safe — if the subdomain is genuinely unused, the record should not exist. Do the DNS change first: while the record is live, the name remains claimable by anyone.
Which services are checked?
The ones with a documented, reproducible takeover path and a distinctive unclaimed-resource response — GitHub Pages, Heroku, Amazon S3, Azure, Shopify, Fastly, Pantheon, Ghost, Bitbucket, Read the Docs, Zendesk, Webflow and others. Services whose only signal is a generic 404 are deliberately excluded, because they cannot be told apart from a working site.
Can I check a domain I do not own?
This performs a DNS lookup and one ordinary HTTP request, which is what any visitor does. Reading the result is not an attack. Acting on a dangling record you find on infrastructure that is not yours would be, and is a different matter entirely.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.