Dangling DNS: are your decommissioning controls keeping up?

TL;DR: Billions of forgotten and misconfigured subdomains, plus 16,000 dangling subdomains in a 12,500-domain sample, can be turned into takeover opportunities that support phishing, credential harvesting, cookie theft, and broader trust abuse, according to Silent Push's Danglegeddon simulation. The governance gap is not discovery alone but decommissioning order, ownership, and verification.

Editorial analysis by NHI Mgmt Group, based on content published by Silent Push: “Welcome to Danglegeddon”.

By the numbers:

• Silent Push reported that 5,000 subdomains were safe due to the provider's safeguard measures.

Key questions

Q: What breaks when a DNS record outlives the service it points to?

A: The trust chain breaks because the subdomain still appears legitimate even though the organisation no longer controls the destination behind it.

Q: Why do dangling DNS records create a real subdomain takeover risk?

A: Dangling DNS records create risk because they still direct traffic to a name that no longer points to an active backend.

Q: What are the signs that DNS decommissioning controls are failing?

A: Look for old resource references, orphaned CNAMEs, subdomains linked to retired cloud assets, and certificates still possible for abandoned names.

Practitioner guidance

• Enforce DNS teardown before resource retirement Remove authoritative DNS records before deprovisioning the underlying cloud resource, and block change completion until the hostname no longer resolves to claimable infrastructure.
• Assign named ownership to every namespace Attach an accountable owner and review date to each DNS record, including inherited subdomains created during M&A, layoffs, or platform migration.
• Verify custom hostname ownership continuously Require provider-side domain verification, such as TXT-based validation, before allowing custom hostnames or certificate issuance for externally reachable services.

Bottom line: Dangling DNS is a lifecycle and trust problem, not just a misconfigured record, because the namespace can outlive the service behind it.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →