CNAME Takeover

How CNAME Takeover Works

CNAME takeover is a DNS subdomain hijack, but the weakness is not in DNS itself. It appears when a subdomain is delegated by CNAME to an external provider that no longer controls or reserves the target name, leaving a dangling trust path.

The practical issue is that the original domain owner may still publish DNS that looks legitimate, while the external destination is free for an attacker to register or reclaim. That makes the trusted subdomain capable of serving content under the victim's brand without changing the DNS record on the parent domain.

Why Dangling CNAMEs Are Dangerous

A dangling CNAME matters because browsers and users usually trust the visible parent domain, not the upstream service behind it. If an attacker claims the abandoned target, they can use the subdomain to host convincing phishing pages, inject script into a trusted origin, or harvest cookies and session data where browser scope and application design allow it.

This is especially damaging when the subdomain is used for login flows, marketing assets, file delivery, or application components that inherit trust from the parent domain. The risk is often amplified by long-lived DNS records and weak inventory hygiene, because the takeover can remain possible long after the original service was decommissioned.

How Organisations Check Exposure

Exposure review starts with an inventory of subdomains, CNAME records, and the external services they reference. Teams should compare DNS against vendor records, application ownership, and decommissioned assets to identify names that point to services no longer in use.

It is also important to check whether the target hostname is still claimed by the vendor, whether the service has been retired, and whether the subdomain is reachable from the internet. A CNAME can be harmless in a staging note and dangerous in production, so validation has to include actual resolution and content observation, not just zone-file review.

For a control-oriented baseline, NIST SP 800-53 Rev 5 Security and Privacy Controls is useful for aligning ownership, access control, and configuration review around DNS-dependent assets.

Mitigation and Detection After a Takeover

The safest fix is to remove or update the dangling CNAME so it points only to an owned and actively claimed service. If a patch cannot be applied immediately, teams should suspend the exposed subdomain, redirect it to a controlled endpoint, or otherwise eliminate the abandoned trust path before an attacker can claim it.

Detection should look for unexpected content, certificate changes, hosting changes, or redirects on subdomains that were previously tied to third-party services. After remediation, review logs and browser-facing behavior for signs of compromise, including credential capture, script injection, session abuse, or suspicious traffic from the affected origin.

For a broader control lens on this kind of exposure, NIST Cybersecurity Framework 2.0 helps organisations tie asset identification, protective controls, detection, and recovery together.

Risk and Threat Considerations

CNAME takeover is dangerous because it turns a forgotten dependency into an externally claimable trust boundary. The risk is not limited to brand damage, an attacker who controls the dangling destination can exploit the inherited origin trust to capture data or deliver malicious content under a legitimate-looking subdomain.

Failure mechanism: The organisation leaves a CNAME pointing to a third-party name or service that is no longer reserved, allowing another party to register the target and receive traffic intended for the trusted subdomain.

Impact: Users may be redirected to attacker-controlled content on a trusted origin, which can enable phishing, cookie theft, session abuse, or script-based compromise of the subdomain's trust relationship.

Practitioner Guidance

What to watch for: Treat every DNS change, vendor migration, and service decommission as an ownership event, not just an infrastructure change. The key judgement is whether the external target still exists, is still owned, and still matches the intended trust boundary.

Practitioner takeaway: If a CNAME is no longer tied to an actively claimed destination, remove it or rehome it immediately, because the security issue is the dangling claim, not the DNS syntax.

Related resources from NHI Mgmt Group

• What is the difference between a suspicious login and an account takeover sequence?
• How should security teams respond to account takeover in SaaS environments?
• Why do MFA controls still fail against account takeover?
• What is the difference between credential theft and account takeover?