Dangling DNS Records Can Outlive the Services They Point To

Mon, 14 Sep 2026 00:00:00 +0700

A hostname can remain part of an organisation’s public identity long after the application behind it has disappeared. The DNS record still resolves, certificates may have existed for years, links remain in old messages, and browser cookies may still be scoped broadly enough to include the name. Yet the external service named by that record may have been deleted and returned to a provider’s pool of available resources.

That mismatch creates the conditions for subdomain takeover. The core problem is not DNS compromise. The authoritative zone can be operating exactly as configured. The failure sits between two control planes: DNS still delegates traffic toward an external platform, while the platform no longer associates the referenced resource with the domain owner.

Dangling DNS Records Preserve Authority After Services Disappear

Sun, 13 Sep 2026 00:00:00 +0700

A product team deletes an old hosted application, the cloud resource disappears, and the monthly bill stops. The public hostname often survives. Months later, preview.example.com still resolves through a CNAME to a provider-specific name associated with a resource that no longer exists. From the organisation’s perspective the application is gone. From DNS’s perspective, authority is still being delegated.

That mismatch creates the conditions associated with subdomain takeover. The important detail is not simply that a DNS record points at a dead destination. Exploitation also depends on the external service allowing another party to claim the referenced name, tenant, site, bucket, project, or equivalent routing identifier. A dangling record is therefore evidence of stale control; whether it is directly exploitable depends on the provider’s ownership model.

Cloud Security on Nalar

Dangling DNS Records Can Outlive the Services They Point To

Dangling DNS Records Preserve Authority After Services Disappear