News
Dangling CNAME vs Abandoned SaaS Subdomains
May 10, 2023
Dangling CNAME vs abandoned SaaS subdomains is the same failure seen from two sides. A dangling CNAME is DNS that still points at a provider host after you deleted the project. An abandoned SaaS subdomain is the empty project slot someone else can claim. Together they let a stranger serve content on a hostname customers still trust. RoastMyOpsec only raises this when a provider CNAME and a known unclaimed-resource fingerprint agree — it does not attempt to claim anything.
The practical difference
The DNS record is your responsibility. The SaaS slot is the vendor's provisioning model. You must clean both: remove the CNAME, then delete or reclaim the vendor app.
Not every NXDOMAIN or placeholder page is a takeover. False positives are why evidence has to match a known fingerprint, not a vibe.
How to choose a cleanup order
Inventory CNAMEs at the registrar or DNS host. Match each target to a live vendor project you still own. If the project is gone, remove the DNS first so the name stops resolving, then confirm the vendor dashboard.
| Symptom | Likely cause | First move | Takeaway |
|---|---|---|---|
| CNAME to vanished Heroku/GitHub/S3-style host | Project deleted, DNS left behind | Delete the CNAME | Do not wait for the vendor to expire it |
| Vendor still has the app, DNS moved | Orphaned project | Delete or lock the vendor app | Stop paying for ghosts, stop leaking names |
| Wildcard *.example.com to a dead target | Broad blast radius | Narrow the wildcard | Wildcards make cleanup harder |
Why this is still showing up
Preview environments, old landing-page builders, and forgotten helpdesks are the usual leftovers. The marketing team launched on a vendor, the engineering team moved to a new host, and DNS was 'someone else's ticket.'
Treat decommission as a checklist: DNS, TLS certs, vendor project, analytics property, and any email CNAMEs.
Common mistakes
The first mistake is pointing a brand subdomain at a vendor 'just to try it' and never deleting the record.
The second mistake is a wildcard CNAME for convenience.
The third mistake is assuming a 404 on the vendor host means nobody can register the slot.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a dangling CNAME the same as subdomain takeover?
- A dangling CNAME is the DNS half. Takeover is what happens if the provider lets someone else claim the target. Fix DNS even if takeover is not currently possible.
- Will RoastMyOpsec try to take over my subdomain?
- No. The check is a public CNAME lookup plus known unclaimed-resource fingerprints. Nothing is registered or claimed.
- How often should I audit CNAMEs?
- Whenever you decommission a vendor, and on a quarterly DNS review for marketing subdomains.