Dangling CNAME and subdomain takeover

Which name this alias points at. An alias whose target resolves to nothing can be claimed by whoever registers it at that provider, and then serves this domain.

• Help center

A CNAME record makes one name an alias of another: www.example.com CNAME example.netlify.app means "ask that name instead". Aliases are how sites are attached to CDNs, hosting platforms, shop builders and landing-page tools.

The danger is the dangling CNAME. When the service at the target is cancelled but the alias stays in DNS, the target stops resolving — and on many platforms anyone can then create an account and claim that same name. From then on they serve whatever they like on your subdomain, with your cookies in scope and your domain in the address bar. This is called subdomain takeover.

How SiteScan checks

The scan checks whether www of the registrable domain is a CNAME. If it is not, the row does not appear. If it is, the row shows the target and SiteScan looks up the target's A record: when it resolves, the row is green; when it returns nothing, the alias is dangling and the row turns red. The check is skipped on zones with a wildcard, where every name resolves anyway.

How to fix it

Either reconnect the target (reclaim the name at the provider, restore the project) or delete the CNAME. Make removing DNS records part of decommissioning any external service, and review other aliases in the zone the same way.