Dangling DNS Records Expose Companies to Subdomain Takeovers Years After Projects Shut Down
A marketing team requested reactivation of a three-year-old promotional landing page, only to discover that its domain now served an unrelated third-party website. The root cause was a forgotten CNAME record in the company's DNS zone that continued pointing to a project name on external hosting after the original service had been decommissioned. Because many hosting providers use wildcard DNS entries, standard availability checks and simple DNS resolution tests fail to detect that the target project no longer exists. Attackers who re-register the freed project name can then serve content under the company's legitimate subdomain, automatically obtaining valid TLS certificates and inheriting domain-wide cookies. The article details how such dangling records accumulate across infrastructure, marketing, and acquired company zones, and explains the concrete risks including cookie theft, bypass of Content-Security-Policy, and unauthorized domain ownership proofs. It concludes with a practical remediation workflow: export the full zone, assign owners to every record, validate external targets by application response rather than DNS resolution, and embed record removal into decommissioning procedures.
HabrSep 4, 2026Translated from Russian