What is Subdomain takeover?

Subdomain takeover is a web security vulnerability where an attacker gains control of a trusted subdomain because its DNS record points to an unclaimed or deprovisioned external service.

It usually happens after a SaaS app, cloud resource, CDN endpoint, storage bucket, or hosting project is removed while the DNS entry remains active. The result is a legitimate-looking domain that can serve attacker-controlled content.

How does it work?

A subdomain often uses DNS records such as CNAME records to point users to a third-party service. If that service is deleted but the DNS record still exists, the subdomain may point to a resource that no one currently owns.

An attacker can look for this gap, claim the abandoned service name where possible, and host content under the organization’s subdomain. Users, browsers, and some security tools may still trust the domain because it appears to belong to the original organization.

Subdomain takeover vs DNS hijacking

DNS hijacking changes or manipulates DNS resolution, often through registrar compromise, malware, rogue resolvers, or unauthorized DNS configuration changes. Subdomain takeover usually abuses a valid but forgotten DNS record that already points to an external service.

This distinction matters because the DNS account may not be breached. The failure is often lifecycle-related: teams remove infrastructure but do not remove the corresponding DNS dependency.

How Hexnode supports Subdomain takeover risk reduction

Hexnode does not replace DNS ownership controls, but it supports the endpoint side of prevention and response. With Hexnode UEM, teams can maintain endpoint visibility, review compliance status, enforce policy enforcement, restrict risky applications, deploy patches, and take remote actions when a hijacked subdomain is used for phishing, malware delivery, or credential theft.

This endpoint context helps security teams respond faster when users interact with suspicious trusted-looking domains. Hexnode also supports application controls and browser-related governance that reduce exposure during web-based incidents.

When should organizations use it?

Subdomain takeover prevention should be part of cloud deprovisioning, DNS audits, external attack surface reviews, and vendor offboarding. It is especially important for organizations with many temporary projects, marketing microsites, developer environments, and SaaS integrations.

Teams should also test for takeover risk before launching new services, retiring old services, or changing providers. A clean inventory of subdomains, owners, DNS records, and connected services is the strongest starting point.