Forgotten subdomains and DNS records that point nowhere: how they get hijacked

The short answer: when you stop using a service but forget the DNS record that pointed to it (a CNAME to a shop, a blog or an application you cancelled), someone can open an account at that service, claim the name and show whatever they like on your subdomain, with your domain in the address. The defence is simple: clean the DNS.

What the site needs

What What to do
How it happens A subdomain (shop.your-domain.com) points by CNAME to a service. The service is cancelled, but the record stays. Another customer of the service claims the name.
What the attacker gains A page with your domain in the address: useful for scams, for stealing passwords and for looking legitimate.
Address records (A) An A pointing to an IP that is no longer yours may end up on someone else’s machine.
Warning signs Subdomains that show the service’s error (“site not found”, “does not exist”) or pages you do not recognise.
Who is at risk Anyone who has had several services, changed provider or application, and never cleaned the DNS zone.

Getting started

1 Take a copy of the zone: open the Zone Editor and keep a list (or a screenshot) of all the records.
2 Go through each CNAME and each A and ask: where does it point, and do I still use that? DNS records.
3 Open each subdomain in the browser: if it shows the destination service’s error, it is a candidate.
4 Delete the ones you do not use. A record that serves nothing can only do harm. If you are not sure, change it temporarily so you can delete it a few days later.
5 When you cancel a service, delete its DNS record the same day. When you move DNS, check the list: Moving the DNS zone.
Do not delete blindly. Some records look odd but serve e-mail or a verification (MX, TXT, SPF). If in doubt about a record, ask first: deleting the wrong one can cut your e-mail. The e-mail records are in SPF, DKIM and DMARC.
To limit who can issue certificates for your domain, see CAA records. For a subdomain that points to another service: A or CNAME.

Found a subdomain you do not recognise? Open a ticket with the name and do not delete it before telling us.

Open a support ticket

SEE ALSO

DNS records explained: A, CNAME, MX, TXT and TTL

Moving your DNS zone to a new provider and checking it before you switch

CAA records: who may issue certificates for your domain

Pointing a subdomain to another server or service: A record or CNAME

SPF, DKIM and DMARC: why your e-mail lands in spam

RECOMMENDED PRODUCT

Register your .com domain

Secure your company name before someone else registers it. from $17.00/yr

Search a domain
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
How to activate and install a paid SSL certificate Every domain here already gets a free certificate automatically - see what an SSL certificate is. This page is only for...