Subdomain Takeover Checker

What is a subdomain takeover?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

A subdomain takeover happens when a DNS name still points (usually by CNAME) at a cloud resource that was deleted, so anyone can claim that resource and serve content on your subdomain. This checker resolves the CNAME of the name you enter, matches it against eight services and looks for their unclaimed-resource page.

Takeovers usually follow a decommissioned project: a GitHub Pages site, Heroku app, S3 bucket or Azure web app is deleted, but its CNAME stays in DNS. The attacker registers the same resource name and now controls a page on your domain, useful for phishing or for stealing cookies scoped to it.

Services checked: GitHub Pages, Heroku, AWS S3, Azure App Service, AWS CloudFront, Shopify, Surge.sh and Fastly. Only the exact name you enter is tested; it doesn't discover your other subdomains.

How do I check a subdomain for takeover?

Enter the full subdomain, for example docs.example.com.
Check the CNAME and whether it matched a known service.
If a takeover is flagged, remove the DNS record or reclaim the resource straight away.

How to read the results

CNAME: Where the name points. No CNAME means there is nothing here for this check to find.
Matched service: The provider recognised from the CNAME target, if any.
Finding: Critical when the page at https://<name>/ contains that provider's 'no such site' message: the resource looks unclaimed.

How to fix a dangling record

Possible subdomain takeover via GitHub Pages

Delete the CNAME, or recreate the Pages site with the custom domain set. Verify your domain in GitHub's settings so others can't claim it.

docs.example.com.  CNAME  example-org.github.io.

S3 NoSuchBucket

Delete the CNAME, or create the bucket with the exact name in your own account.

Examples and command-line equivalents

Find CNAMEs in your zone that point outside it

dig +short CNAME docs.example.com
curl -sk https://docs.example.com/ | head -20

Frequently asked questions

How do I prevent subdomain takeovers?

Delete DNS records before deleting the resources they point to, review CNAMEs to third-party services regularly, and use the domain-verification features GitHub, Azure and others offer.

Does a clean result mean my domain is safe?

It means this name isn't vulnerable to the eight services checked. Other subdomains, other providers and dangling A records pointing at released cloud IPs need checking too.