SharkDNS guide
6 min readSubdomain takeover explained
What dangling CNAME records are, why they enable subdomain takeover, and how to find and fix them.
subdomain takeoverdangling CNAMEDNS securitybug bounty
When to use it
Scan after decommissioning hosted services, during security audits, when monitoring attack surface, or as part of a bug bounty recon workflow.
How takeovers happen
A CNAME points blog.example.com at a service like GitHub Pages or Heroku. When the resource is deleted on the provider but the DNS record stays, anyone can claim the same resource name and serve content under your subdomain.
How to remediate
Remove DNS records before deleting the resource on the provider, not after. Regularly scan for CNAME targets that return NXDOMAIN, and treat flagged findings as leads to verify manually rather than proof of exploitability.
More SharkDNS Guides
What is DNS lookup used for?
Use DNS lookup to inspect records, verify routing, troubleshoot mail, and compare public DNS visibility.
Reverse IP lookup explained
Find domains observed on the same IPv4 address and understand shared hosting or infrastructure relationships.
Subdomain discovery for asset inventory
Use public subdomain data to build a cleaner domain inventory and find exposed hosts.