Subdomain Takeover Check: What StackShield Tests

What this check looks for

StackShield inspects your DNS records for subdomains that point at third-party services, then checks whether those services still have the resource claimed. It is hunting for dangling records: a CNAME aimed at a cloud host, CDN or SaaS endpoint that no longer exists and could be re-registered by someone else.

Why it matters

A subdomain takeover happens when you point app.yourdomain.com at a service, later stop using that service, but leave the DNS record in place. The subdomain now resolves to a resource nobody controls. An attacker who registers that same resource name on the provider claims your subdomain and can serve their content from an address your users and systems trust.

The consequences are worse than a random malicious site, because the takeover is on your domain. It can be used for convincing phishing, to steal cookies scoped to your domain, or to bypass origin checks that trust your subdomains.

What a failed check means

A failed check means StackShield found a DNS record pointing at a third-party resource that appears unclaimed, the precondition for a takeover. It does not mean the subdomain is already compromised, but it means the record is a live risk until removed.

The fix is auditing DNS for dangling records and removing any that point at services you no longer use, then treating record cleanup as part of decommissioning any service.

See the step-by-step remediation: how to fix this.