Attack Surface Ranked

FIELD NOTE · 3 SEPTEMBER 2026

Dangling DNS and subdomain takeover: what ASM tools document

Quick answer

A dangling DNS record points to a resource that no longer exists, and an attacker who can claim that resource can serve content from your subdomain. The fix is rarely a patch: it is deleting the record, reclaiming the resource or taking the asset down. IONIX documents claiming such assets on the customer's behalf; other tools document finding them and routing the fix.

By Attack Surface Ranked analysts · Published 3 September 2026 · 3 min read

How does a subdomain takeover happen?

A team creates a subdomain for a campaign or a test and points it at a cloud resource or a hosted service. Later the resource is deleted, but the DNS record stays. The record now points at something anyone may be able to register or create. If an attacker claims it, content they control appears under your domain, with your name on it.

Related cases work the same way: a domain that was allowed to expire, a cloud storage bucket that was deleted while links to it remain, or a nameserver delegation that nobody manages any more.

Why do large groups have more of them?

Because DNS outlives projects. Every brand, campaign, regional site and acquisition adds records, and the people who created them move on. After an acquisition, the acquired company's DNS may be managed by a different team or provider for years. Records like these do not show up in a vulnerability scan of known hosts, because nothing is running there. They show up in discovery.

What do ASM tools document?

Takeover-related capabilities in vendor documentation, September 2026
ToolWhat the vendor documents
IONIXActive Protection purchases expired domains, claims abandoned cloud buckets and locks down exposed nameservers on the customer's behalf.
watchTowrA DNS agent among its eight attack agents.
Censys ASMIn July 2026 Censys added real-time DNS visibility to its Internet Map, bringing domains, DNS records, IPs, hosts, services and certificates into one view.
Microsoft Defender EASMRecursive discovery from seeds including domains, hosts and Whois organizations.

This is what each vendor documents on the pages we reviewed, not a full list of what each product does. Most discovery tools will surface a dangling record as a finding; fewer describe acting on it.

What is the fix?

It depends on what the record points to.

  • If the resource is no longer needed, delete the DNS record. This is the most common and cheapest fix.
  • If the name still matters, reclaim the resource before anyone else does, then decide whether to keep or retire it.
  • If a domain has expired, re-register it or confirm it can be released safely.
  • If a nameserver delegation is unmanaged, bring it back under your DNS provider or remove it.

This is why our remediation criterion counts claiming hijackable assets as a form of mitigation, alongside WAF rules. A virtual patch cannot help here, because there is no application to put a rule in front of.

How do you prevent new ones?

  1. Make DNS removal a step in every decommissioning checklist, before the resource is deleted.
  2. Give every subdomain an owner in the same inventory your ASM tool feeds.
  3. Review DNS for acquired companies in the first weeks after the deal, not at the end of integration.
  4. Set domain renewals to automatic for anything customer-facing, and keep a list of domains you intend to let expire.
  5. Ask your ASM vendor how quickly a new dangling record is reported, and whether it can reclaim the resource or only report it.

Where does this fit in a program?

Takeover risks are a good test of whether a tool helps close exposures or only lists them, because the fix is operational rather than a patch. In a proof of concept, ask each vendor to show one dangling record on your estate, the evidence that it is yours, and what happens next. The buyer's guide lists the other checks to run.

Sources

Related on this site