Privacy controls
CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.
Detect dangling CNAME records that point to expired or uncontrolled domains. Prevent subdomain takeover attacks by identifying vulnerable CNAME configurations.
A dangling CNAME is a DNS CNAME record that points to a domain that no longer exists, has expired, or is not under your control. CNAME records create aliases — they redirect DNS queries from one hostname to another. When the target domain expires, is deleted, or changes ownership, the CNAME becomes "dangling" — pointing to nothing or to a domain controlled by someone else. Attackers routinely scan for dangling CNAMEs and register the expired target domains to take control of the source subdomain. This is called a subdomain takeover attack and is one of the most common DNS security vulnerabilities affecting cloud-hosted applications, CDNs, and third-party services.
Subdomain takeover via dangling CNAMEs allows attackers to host content on your domain, issue valid SSL certificates, intercept traffic, steal cookies, and damage your brand reputation. It's a critical vulnerability that affects thousands of organizations.
Creating CNAMEs to third-party services (Heroku, GitHub Pages, Shopify, Azure) without monitoring the target, not removing CNAMEs when migrating away from a service, deleting cloud resources but leaving DNS records, and not regularly auditing CNAME configurations for dangling targets.
Type the domain to scan for dangling CNAME records.
We query all CNAME records for the domain and its subdomains.
We attempt to resolve each CNAME target to check if it's still valid.
Dangling targets and takeover risks are flagged with severity ratings.
Queries all CNAME records for the domain and common subdomains. Tests both direct CNAME queries and zone enumeration to find hidden CNAME aliases that may have been forgotten.
Attempts to resolve each CNAME target to verify it still exists and is reachable. Checks DNS resolution, HTTP response, and whether the target responds with a known error page indicating a takeover opportunity.
Analyzes each dangling CNAME to determine the takeover risk based on the target domain type. Some targets (Heroku, GitHub Pages, Shopify) are easily claimed by anyone. Others require domain registration or DNS control.
Identifies CNAMEs pointing to common third-party services like AWS, Azure, Heroku, GitHub Pages, Shopify, Wix, and CDNs. Many dangling CNAME vulnerabilities originate from these platforms when resources are deleted but DNS records remain.
Evaluates whether an attacker could obtain a valid SSL certificate for a taken-over subdomain using ACME protocols (Let's Encrypt). Dangling subdomains with valid certificates are especially dangerous as they appear legitimate to users.
For each dangling CNAME found, we provide specific remediation steps. This includes removing the CNAME record, updating it to the correct target, or claiming the expired target domain before an attacker does.
Automate dangling CNAME detection, monitor your entire domain portfolio for takeover risks, get alerted when new dangling records appear, and prevent subdomain takeovers before attackers find them.