Dangling Subdomain

Severity: High

What is a dangling subdomain?

A dangling subdomain is a DNS record (usually a CNAME) whose target no longer resolves. For example, if you created blog.example.com as a CNAME pointing to example.ghost.io and later cancelled your Ghost account, the CNAME still exists but there are no A or AAAA records behind the target any more. The subdomain is "dangling" — pointing at nothing active.

DNS Watchdog raises this issue when the daily scan resolves a CNAME target and gets no answer. It is a resolution finding: the target is gone, but DNS Watchdog has not confirmed that anyone else could claim it. When the target still answers and its response matches the "unclaimed resource" signature of a known takeover-prone service, the record is raised as a CNAME Takeover Vulnerability (Critical) instead.

Why this is a problem

A dangling subdomain is the precondition for a subdomain takeover. If the abandoned target can be re-registered — a service account, a storage bucket, a hostname on a shared platform — an attacker who claims it controls what your subdomain serves: phishing pages, malware, or fake login forms that appear to be part of your organisation. Even where the target cannot be claimed, the record is dead weight that misleads visitors and hides the records that matter.

Because the target has not been confirmed claimable, this issue is graded High rather than Critical. It still deducts from your DNS Health score and should be cleaned up promptly, before the target is claimed and the finding escalates.

When this is not flagged

Some CNAME records are never meant to resolve to an IP address, so an unresolvable target is expected rather than a risk. DNS Watchdog does not raise this issue for:

• Verification and DKIM records — CNAMEs used for domain validation or email signing (for example ACM validation targets or selector._domainkey records pointing at your email provider)
• Email platform return-path records — CNAMEs whose hostname carries MX records, or that point at known email-sending infrastructure such as Shopify authenticated email (*.email.myshopify.com)

What you should do

• Remove the DNS record if the external service is no longer needed
• If the service is still needed, re-provision it so the target resolves again
• Audit all CNAME records pointing to third-party services regularly
• Before cancelling any external service, always remove the associated DNS records first