← All tools

Subdomain Takeover Checker

Checks common subdomain names for a "dangling" CNAME: one pointing at a third-party platform (GitHub Pages, S3, Heroku, Netlify, Vercel and about a dozen more) whose resource there was since deleted. Those can often be silently re-claimed by anyone on that platform, letting them serve their own content and often piggyback on your cookies, CSP and SPF trust from your own subdomain. A clean result means no obvious risk was found among the names checked, not a certified-clear attestation.

📖 Guide: What subdomain takeover is

Last updated: September 9, 2026

How to use this tool

1. Enter your domain and click Scan.
2. Review anything flagged as risky first — those point at a CNAME whose third-party target looks unclaimed right now.
3. For a genuine risk, either remove the dangling CNAME if it's no longer needed, or re-claim the resource on the platform it points to.

Use it after decommissioning a service (a GitHub Pages site, an S3 bucket, a Heroku app) that a subdomain used to point at, or periodically as routine hygiene — a forgotten CNAME is exactly the kind of thing that sits unnoticed for years until someone finds it.