Glossary

Dangling DNS

A DNS record, usually a CNAME, an A record or an NS delegation, that still points to a cloud resource, address or zone that has been deleted or released. Whoever can claim that resource next controls the name, which is how subdomain takeovers happen.

Also called: dangling DNS record · dangling CNAME
Defined in: OWASP Subdomain Takeover Prevention Cheat Sheet

Covered in

Guide

Prevent subdomain takeover from dangling DNS records

A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.