# Dangling DNS subdomain takeover

DNS records pointing at unclaimed cloud, mail, or IP resources anyone can re-register

_Area: Web infrastructure and server-side requests. Seen in 16 disclosed reports; 11 confirmed bounties, median $513, range $200-$10,000; latest 2023-05-30. Updated 2026-10-23._

## How it works
A DNS record (CNAME, A, MX, or NS delegation) still points at a resource the owner no longer controls: a deleted cloud app, a released IP, an unclaimed mail route, or a deleted hosted zone. Whether a stranger can claim that resource depends on the provider's re-registration policy — some verify ownership, some hand the name to any account [E4](https://bugbountylibrary.com/r/blog%3A0xpatrik-com-subdomain-takeover-starbucks-ii.md)[E5](https://bugbountylibrary.com/r/h1%3A173681.md)[E6](https://bugbountylibrary.com/r/h1%3A716677.md). The broken assumption is that "the record exists" means "we own the target." It does not.

## Where it shows up
- CNAME to cloud PaaS/CDN names (azurewebsites.net, trafficmanager.net, wordpress.com, herokuapp.com, s3 buckets) returning NXDOMAIN or a provider "not found"/"domain not mapped" page [E4](https://bugbountylibrary.com/r/blog%3A0xpatrik-com-subdomain-takeover-starbucks-ii.md)[E5](https://bugbountylibrary.com/r/h1%3A173681.md)
- A records to cloud IPs whose instance was terminated and the IP released [E7](https://bugbountylibrary.com/r/h1%3A1295497.md)
- MX records on per-tenant subdomains pointing at SendGrid/Mailgun-style inbound services where the domain is unclaimed [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200822010745-https-whitehatnepal-tumblr-com-post-149985438982-reading-ubers-internal-emails-uber-b.md)[E2](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200817171403-https-whitehatnepal-tumblr-com-post-150381068912-how-i-snooped-into-your-private-slac.md)
- Authoritative NS delegation to a provider with no matching hosted zone (SERVFAIL/NXDOMAIN on apex) [E8](https://bugbountylibrary.com/r/h1%3A1226891.md)
- Adjacent, not a dangling record: CSP allowlists trusting claimable shared-hosting origins like *.freetls.fastly.net [E6](https://bugbountylibrary.com/r/h1%3A716677.md)

## How to review
For every hostname the target owns, resolve the full chain and confirm each hop is still controlled by the target. The invariant: every DNS target (CNAME name, A IP, MX host, NS zone) must be a resource the target currently owns and that the provider will not hand to a stranger. Concretely: run dig for CNAME/A/MX/NS on each name; compare responses against provider "not found" fingerprints; for IPs, check whois and cloud provider ranges to confirm current ownership [E7](https://bugbountylibrary.com/r/h1%3A1295497.md); for NS, check WHOIS nameservers then dig the apex for SERVFAIL/NXDOMAIN [E8](https://bugbountylibrary.com/r/h1%3A1226891.md). Treat NXDOMAIN behind a CNAME, released IPs, and orphaned delegations as takeover candidates. For CSP, only trust origins the target exclusively controls [E6](https://bugbountylibrary.com/r/h1%3A716677.md).

## Variants seen
- Dangling CNAME to unclaimed Azure web app, escalating via shared parent-domain cookies [E3](https://bugbountylibrary.com/r/blog%3Ahacktus-tech-subdomain-takeover-leading-to-full-account-takeover.md)
- Dangling CNAME to a deleted Azure Traffic Manager profile [E4](https://bugbountylibrary.com/r/blog%3A0xpatrik-com-subdomain-takeover-starbucks-ii.md)
- Dangling CNAME to wordpress.com after the site was removed [E5](https://bugbountylibrary.com/r/h1%3A173681.md)
- Dangling A record to a released EC2 IP [E7](https://bugbountylibrary.com/r/h1%3A1295497.md)
- Unclaimed SendGrid Inbound Parse MX route capturing all subdomain mail [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200822010745-https-whitehatnepal-tumblr-com-post-149985438982-reading-ubers-internal-emails-uber-b.md)
- Unclaimed MX on per-tenant Slack subdomains intercepting private messages [E2](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200817171403-https-whitehatnepal-tumblr-com-post-150381068912-how-i-snooped-into-your-private-slac.md)
- Orphaned NS delegation to a deleted hosted zone [E8](https://bugbountylibrary.com/r/h1%3A1226891.md)
- Claimable CDN origin whitelisted in CSP (adjacent) [E6](https://bugbountylibrary.com/r/h1%3A716677.md)

## Impact and severity
Reports in this set: 15, 11 paid, bounty median $513, range $200–$10,000. Impact scales with what the hostname touches: mail interception exposed internal emails and private Slack messages [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200822010745-https-whitehatnepal-tumblr-com-post-149985438982-reading-ubers-internal-emails-uber-b.md)[E2](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200817171403-https-whitehatnepal-tumblr-com-post-150381068912-how-i-snooped-into-your-private-slac.md); shared session cookies turned a test subdomain into full account takeover [E3](https://bugbountylibrary.com/r/blog%3Ahacktus-tech-subdomain-takeover-leading-to-full-account-takeover.md); CSP bypass enabled script execution on the main app [E6](https://bugbountylibrary.com/r/h1%3A716677.md). Cookie Domain scope and CSP trust amplified otherwise low-value dangling records into high severity.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200822010745-https-whitehatnepal-tumblr-com-post-149985438982-reading-ubers-internal-emails-uber-b.md
- E2: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200817171403-https-whitehatnepal-tumblr-com-post-150381068912-how-i-snooped-into-your-private-slac.md
- E3: https://bugbountylibrary.com/r/blog%3Ahacktus-tech-subdomain-takeover-leading-to-full-account-takeover.md
- E4: https://bugbountylibrary.com/r/blog%3A0xpatrik-com-subdomain-takeover-starbucks-ii.md
- E5: https://bugbountylibrary.com/r/h1%3A173681.md
- E6: https://bugbountylibrary.com/r/h1%3A716677.md
- E7: https://bugbountylibrary.com/r/h1%3A1295497.md
- E8: https://bugbountylibrary.com/r/h1%3A1226891.md