Free tool
Dangling CNAME checker
Find CNAME records pointing at targets that no longer exist — the leftover DNS that subdomain takeovers are made of. Enter a hostname, or sweep the usual subdomains of your apex domain.
This tool runs entirely in your browser: DNS questions go straight to Cloudflare's (or Google's) public DNS-over-HTTPS resolver, and nothing you type here reaches Bastion's servers. Only passive, public DNS data is read — the tool never connects to the domain being checked.
How subdomain takeover actually happens
Nobody creates a dangling CNAME on purpose. A team spins up a docs site on GitHub Pages
or a landing page on a marketing platform, points docs.company.com at it,
and ships. A year later the project is retired and the platform resource deleted — but
DNS lives in a different console, owned by a different team, and the record stays.
The record now answers with a name nobody holds. On platforms where names are claimable, an attacker registers the target and instantly serves their page on your subdomain: real domain in the address bar, often a valid certificate, and a credible base for phishing your users or your staff. Bug bounty programs pay out for these weekly.
The fix is always the same and always cheap: delete the record, or reclaim the target. The hard part is knowing the record exists — which is a monitoring problem, not a one-afternoon-audit problem.
Questions
What is a dangling CNAME?
A CNAME record that points at a hostname which no longer exists — typically left behind when a site, trial, or cloud resource was shut down but its DNS record was not. The record answers, the destination doesn't.
Why does a dangling CNAME matter?
On shared platforms like GitHub Pages, S3 website endpoints, Azure, or Heroku, the target name may be claimable by anyone. Whoever claims it serves their content on your subdomain — with your name on the address bar and, often, cookies scoped to your domain in reach. That is a subdomain takeover.
How does this checker decide a CNAME is dangling?
It resolves the CNAME chain over DNS-over-HTTPS, then asks whether the final target still exists in DNS. An NXDOMAIN answer for the target is the definitive dangling signal. The check is passive: only public DNS is read, and no connection is ever made to the domain or its target.
Does a resolving target mean I'm safe?
Mostly, but not forever. A record pointing at a claimed platform resource is fine today and becomes a takeover the day that resource is deleted without the DNS going with it. The durable fix is process — delete DNS records when you decommission what they point at — and monitoring that tells you when one starts dangling.
Checked once. Now have it watched.
This page checks the names you can think of, today. Bastion discovers subdomains you've forgotten from certificate transparency logs, watches every DNS record for changes, and alerts you when something starts dangling — continuously, on domains you've verified you own.
7-day trial of the full product, no card required. Scanning needs domain ownership verified by DNS — Bastion never scans anything you haven't proved you control.