CNAME Takeover Vulnerability
A subdomain's CNAME points to a decommissioned third-party service that an attacker could re-register.
Severity: Critical
What does this mean?
A subdomain in your zone has a CNAME record pointing to a third-party or cloud service that has been decommissioned, but the CNAME record still exists. DNS Watchdog fetched the target and matched its response against a fingerprint database of takeover-able services, confirming that the service behind the CNAME is unclaimed and can be re-registered.
This is the confirmed, fingerprint-verified case. Unlike a Dangling Subdomain — where the target simply no longer resolves and DNS Watchdog cannot tell whether anyone could claim it — here the target still answers, DNS Watchdog has positively identified the service behind it, and it has recognised the specific "unclaimed resource" signature that service returns. That is why it is treated as an active, exploitable finding rather than a possible one.
The issue details name the matched service and the fingerprint that confirmed it, so you can verify the finding yourself before acting.
Why this is a problem
Because the target service is unclaimed, an attacker can register it themselves — signing up for the same service with the same name — and immediately serve content from your subdomain. Any content they choose is then delivered from a legitimate subdomain of your organisation: phishing pages, malware, or fake login forms that appear to be part of your infrastructure.
This is one of the most severe DNS findings. A single open Critical issue caps your DNS Health grade at D until it is resolved.
What you should do
- Remove the CNAME record if the service it points to is no longer used
- If the service is still needed, reclaim or re-provision it so that you own the target again
- Audit CNAME records pointing to third-party services regularly
- Always delete the DNS record before decommissioning the service it points to