> ## Content Index > Fetch the complete content index at: https://debugly.dev/llms.txt > Use this file to discover other available public pages before exploring further. # The Dangling CNAME That Let a Stranger Serve Your Subdomain - URL: https://debugly.dev/dangling-cname-subdomain-takeover/ - Published: 2026-10-09T17:10:00.000Z - Updated: 2026-10-17T05:55:42.000Z - Description: The staging bucket was deleted and the DNS record stayed, so anyone could claim the same name and serve content from a hostname on your domain, and the… - Author: Rohit Bhadani - Tags: Security, DNS, Infrastructure It ended at the takeover. It started at the page. Every hand-off in between did exactly what it was told, and this is the one that lied. Strip the subdomain takeover down and one property makes it credible: the attacker's content is served from a hostname on your domain, so the address bar shows your name, and the name is the trust the user checks. This was an S3-backed staging subdomain, and the mechanics are the same for any CNAME pointing at a third-party resource that can be claimed by name. ## Why the record was claimable The CNAME pointed at the bucket, and the bucket was the deleted, and the deleted was the name's freedom, and the freedom was the registration, and the registration was the attacker's, and the attacker's was the same name, and the same name was the resolution, and the resolution was the attacker's bucket, and the bucket was the content, and the content was the served on your subdomain. The DNS record was the not deleted, and the not deleted was the cleanup's miss, and the miss was the decommission, and the decommission was the resource without the record, and the record was the dangling, and the dangling was the invitation, and the invitation was the takeover, and the takeover is the reason the record's deletion belongs in the decommission checklist. The takeover is the cheap, and the cheap is the automation, and the automation is the scanning, and the scanning is the constant, and the constant is the minutes, and the minutes is the window, and the window is the small, and the small is the reason the dangling record is the immediate risk rather than the theoretical one. ## Why the domain made it credible The address bar was the staging dot yourdomain, and the yourdomain was the trust, and the trust was the user's check, and the check was the pass, and the pass was the credential's entry, and the entry was the theft, and the theft was the incident, and the incident was the domain's lending. The subdomain is the same site for the cookie's scope, and the scope is the shared, and the shared is the readable if the cookie's domain is the parent, and the parent is the common setting, and the setting is the takeover's escalation, and the escalation is the session, and the session is the worse, and the worse is the reason the cookie's domain should be the narrowest that works. This is the same borrowed trust as [the open redirect that made the phishing link look legitimate](https://debugly.dev/open-redirect-legitimized-phishing/), and the common root is the property, not the platform. ## The fix, in order **Deleted the DNS record when the resource went.** The decommission was the record's removal, and the removal was the dangling's absence, and the absence was the fix, and the fix was the checklist, and the checklist was the discipline, because the record outliving the resource is the invitation. **Scanned for the dangling records.** The scan was the every CNAME, and the every was the resolution's check, and the check was the unclaimed target, and the unclaimed was the alert, and the alert was the fix, and the fix was the scheduled job, and the job was the discipline, because the manual audit is the once and the records are the constant. **Avoided the wildcard CNAME.** The wildcard was the every subdomain, and the every was the unbounded, and the unbounded was the attack's surface, and the surface was the reduction's target, and the target was the explicit records, and the explicit was the fix. **Scoped the cookies to the narrowest domain.** The cookie's domain was the host, and the host was the subdomain's isolation, and the isolation was the takeover's limit, and the limit was the fix, and the fix was the attribute, and the attribute was the discipline, because the parent-domain cookie is the shared secret. **Claimed the names you might use later.** The reserved was the placeholder, and the placeholder was the unclaimable, and the unclaimable was the fix, and the fix was the empty bucket or the parked record, and the parked was the discipline, because the freed name is the available name. **Verified the takeover from outside before assuming it was clean.** The check was the resolution from the public resolver, and the resolver was the user's view, and the view was the served content, and the content was the ownership's test, and the test was the fix, because the record in your zone file says nothing about who answers at the other end of the CNAME, and the other end is the only thing that matters. ## The takeaway A CNAME pointing at a deleted third-party resource can be claimed by anyone who registers the same name, and the content is then served from a hostname on your domain. Delete the DNS record when the resource goes, scan for dangling records on a schedule, avoid wildcards, scope cookies to the narrowest domain, and reserve names you may reuse. The staging bucket was deleted and the DNS record stayed, so an attacker registered a bucket with the same name and served a phishing page from staging.yourdomain.com, and users trusted it because the address bar showed the real domain. I now check for that property first, because it is where the failure actually lives. --- Published on [debugly.dev](https://debugly.dev/) by [Rohit Bhadani](https://debugly.dev/about/) | Founder of [Krova Cloud](https://krova.cloud/?ref=debugly.dev)