A subdomain takeover happens when a subdomain of your site points to an external service that no longer exists, and an attacker claims that service. The attacker then controls what visitors to your subdomain see.

How it happens

Suppose your main domain is example.com and you host a project on a third-party platform such as Heroku or GitHub Pages. You create a DNS record so that work.example.com points to the platform's address, for example workhard.herokudns.com.

Later you stop using the service or the subscription ends, but the DNS record stays. The platform address is now free. An attacker registers it, and work.example.com starts serving the attacker's content.

Why it matters

• Visitors trust the subdomain because it belongs to your domain, so a fake login page there is very convincing.
• Cookies scoped to the parent domain may be sent to the attacker's site.
• The attacker can host malware or damaging content under your brand.

Prevention

• Remove the DNS record whenever you stop using an external service. Delete the DNS entry before you delete the service.
• Keep an inventory of your subdomains and the services they point to.
• Audit your DNS records regularly for entries that point to resources you no longer own.

How Vooki Pro helps

• Checks for subdomain takeover and dangling DNS records.
• Tests related client-side issues such as dangling markup.
• Host scope options let you scan all of a domain's subdomains in one go.

Frequently asked questions

What causes subdomain takeover?

A DNS record (often a CNAME) still points to a cloud service or third-party resource that was deleted, so anyone can claim it.

How do I prevent subdomain takeover?

Remove DNS records when you decommission services, and audit your DNS regularly.

Related: Secure cookie flags: Secure, HttpOnly and SameSite · Scoping a security scan correctly