SharkDNS Live Query
Takeover
Scan subdomains for dangling CNAME records that could allow subdomain takeover.
No scan yet
Enter a domain to scan discovered subdomains for dangling CNAME records pointing at claimable hosting services.
How This Query Works
A subdomain takeover happens when a CNAME points at a third-party service whose resource was deleted but the DNS record remains.
Subdomains are discovered from public certificate transparency and DNS datasets, then their CNAME targets are resolved.
A CNAME target that returns NXDOMAIN on a claimable platform (GitHub Pages, Heroku, S3, Azure, and more) is flagged as potentially vulnerable.
Always verify manually on the provider before assuming a target is claimable; fingerprints are heuristic.
TakeoverDangling CNAMESecurityBug bounty
Related Guides
Short articles explaining when and why to use this query.
Subdomain takeover explained
6 min readWhat dangling CNAME records are, why they enable subdomain takeover, and how to find and fix them.
What is DNS lookup used for?
4 min readUse DNS lookup to inspect records, verify routing, troubleshoot mail, and compare public DNS visibility.
Reverse IP lookup explained
3 min readFind domains observed on the same IPv4 address and understand shared hosting or infrastructure relationships.