Subdomain takeover — dangling CNAME

What it is

Your domain’s DNS contains a CNAME record pointing to an abandoned cloud service. A typical scenario:

Years ago, someone created blog.example.cz with a CNAME to example-blog.herokuapp.com.
The Heroku app was deleted long ago, but nobody removed the CNAME from DNS.
An attacker registers on Heroku, creates an app named example-blog, and takes over your subdomain.

Why it’s a problem

The attacker is now serving content under your domain name — and both users and search engines trust them as they trust you. Specifically, they can:

Host phishing under blog.example.cz (users see your HTTPS, your subdomain).
Issue a Let’s Encrypt cert — green padlock, no warning.
Read your root domain’s cookies if they’re set on .example.cz without HostOnly.
Send emails with links to your subdomain (bypassing spam filters).

This isn’t theoretical. Heroku, AWS S3, GitHub Pages, Azure CDN, Shopify, and other services all allow “register-and-take-over” unless the specific service is secured with pinning (many don’t do this).

How to fix it

Step 1 — confirm the problem is real

You know the specific subdomain from the report. Open it in your browser:

If you see the service’s official error page (“No such app” from Heroku, “404 not found” from GitHub Pages,“NoSuchBucket” from AWS S3) — it’s probably a real takeover.
If you see your own content — the subdomain is active and the problem probably doesn’t exist (a false positive from the scanner).

Step 2 — decide

You no longer need the subdomain. Delete the CNAME from your DNS.
The subdomain should exist again. Create a new app / bucket / Pages site with the same name the CNAME points to — before the attacker does.

Step 3 — regular hygiene

Subdomain takeover happens because you forget to clean up DNS. Put in place:

A regular audit of all CNAMEs — export the zone every quarter and manually verify each external target. For small domains, dig +short ANY example.cz is enough.
An automated takeover scanner: subfinder + nuclei (nuclei -t http/takeovers/).

Watch out for inherited old marketing subdomains

landing.example.cz from a five-year-old campaign, hosted on a cancelled Unbounce. old-blog.example.cz from a migration to Medium. These are the classic targets.