Subdomain takeover is one of the cleanest examples of why external attack surface management matters, because it is a serious vulnerability that lives entirely in something most organisations never look at: a stale DNS record. There is no unpatched software involved, no weak password, no phishing. There is just a pointer left aiming at a service that is no longer yours, and an attacker who claims what it points to.
How the Dangling Record Happens
The setup is mundane. Your organisation creates a subdomain, say promo.example.com, and points it with a CNAME record at a cloud service: a hosting platform, a marketing tool, a documentation host. The campaign ends. Someone deletes the account on the cloud service, or simply stops paying for it. But nobody removes the DNS record. The CNAME still sits in your zone, still pointing at a resource on the provider that no longer exists.
That is a dangling record: a pointer to nothing. On its own it just produces an error. The problem is what happens next.
Claiming the Other End
Many cloud services let anyone claim a resource name if it is free. If your dangling CNAME points at yourbrand.someplatform.com, and that name is now unclaimed on the platform, an attacker can register it. The moment they do, your subdomain resolves to their content. They now control a page on promo.example.com, a real subdomain of your real domain, serving whatever they like.
The damage from there is considerable. The subdomain carries your name and your reputation, so it is a perfect base for phishing that survives the usual checks. It can be issued a valid TLS certificate, so the padlock is genuine. Depending on how cookies are scoped, it may be able to read or set cookies for the parent domain, which can undermine sessions on your main site. And it inherits any trust that other systems place in that hostname.
Why EASM Is the Right Tool for It
This is a vulnerability with no home in the traditional toolkit. A vulnerability scanner pointed at your servers will not see it, because the problem is not on your servers; it is in your DNS, pointing away from you. A penetration test might catch it if the tester happens to enumerate the right subdomain at the right moment. But the natural way to find a dangling record is to do continuous discovery of your subdomains and check, for each one, whether it points at a resource that still exists and is still yours. That is exactly what EASM does. It is the difference between a discipline built to watch the surface and tools built to test individual hosts.
Closing It
The fix for an individual takeover is trivial once you know: remove the dangling DNS record, or reclaim the resource it points at. The hard part is knowing, and that is a process problem as much as a technical one.
- Make DNS cleanup part of decommissioning. When a service is retired, removing its DNS records belongs on the same checklist as closing the account.
- Monitor subdomains continuously for records that resolve to unclaimed or non-existent resources, rather than auditing DNS once a year.
- Keep the number of external services a subdomain has pointed at over its life to a minimum, and know who owns each pointer.
The Short Version
Subdomain takeover happens when a DNS record keeps pointing at a cloud resource after that resource is gone, and an attacker claims the free name at the other end. They then control a genuine subdomain of your domain, complete with a valid certificate, ideal for phishing. Scanners and pen tests are poorly suited to catching it; continuous subdomain discovery, which is what EASM does, is the natural defence. Fixing one is easy. Knowing is the whole game.