Subdomain Takeover Detection Is Live: We Check Every CNAME for Abandoned Targets
We wrote a while back about how every domain accumulates subdomains nobody remembers creating, and how few people ever audit them. Subdomain takeover detection is the automated version of that audit, and it now runs on every Starter+ scan.
What it actually catches
A subdomain takeover happens when a subdomain's CNAME record points at a third-party service, GitHub Pages, Heroku, S3, Netlify, Vercel, Azure, Shopify, and around a dozen others, that no longer has anything registered there. The DNS record is still live. What used to be there isn't. That gap is claimable: an attacker can register the same resource on the third-party service and start serving their own content from your subdomain, inheriting whatever trust, cookies, CORS permissions, brand credibility, was already placed in it.
How we check for it
This rides along on the subdomain discovery Decloak already runs, no separate step, no toggle to switch on. Every discovered subdomain gets a CNAME lookup alongside its normal DNS check, and two signals trigger a critical finding:
- A dangling CNAME. The record points at a known service, but the target doesn't resolve at all. This is the strongest signal, there's genuinely nothing there.
- A body fingerprint match. The CNAME still resolves, but the page it serves matches that service's specific "unclaimed resource" response, S3's
NoSuchBucketerror, GitHub Pages' "There isn't a GitHub Pages site here," and similar tells from other providers.
Where either signal fires, you'll see a red Takeover risk badge directly on that subdomain's row in the report, along with the CNAME target, the service it points to, and the evidence behind the flag. A clean scan doesn't just go quiet on this either, you get an explicit "no takeover risk detected" finding, so you know it was actually checked rather than skipped.
Why we built it
This one was an easy call. Both Detectify and Intruder, the two attack-surface-management tools closest to what Decloak does, treat subdomain takeover monitoring as a headline feature, and it came up independently across two separate rounds of competitive research. It's also cheap to add well: subdomain discovery already existed, this is a CNAME lookup layered on top of a pass we were already running.
Availability
Live now, automatically, on every Starter and above scan. If you're on Starter or up, your next scan will include this without any configuration change on your end.
Subdomain takeover detection is included in every Starter+ scan. See plans →