---
title: "Find Subdomain Takeovers"
canonical: https://trickest.com/library/subdomain-takeover-scanner
description: "Find dangling CNAMEs an attacker could claim on your subdomains, with the service behind each record named so you know who to ask."
---

# Find Subdomain Takeovers

## Overview

Subdomains outlive the things they point at. A marketing site moves, a staging
bucket is deleted, a SaaS trial lapses, and the DNS record stays behind pointing
at a hostname nobody owns any more. Anyone who registers that hostname now serves
content on your domain, with your certificate story and your users' trust.

This finds those records before someone else does. You get an inventory of every
subdomain that resolves, and for the dangling ones, the service sitting behind the
CNAME, which is what tells you whether the record is claimable and who to ask for
it back. That makes it a standing check for
[exposure management](/use-cases/exposure-management) rather than a one-off audit,
because the gap opens the day a service is decommissioned, not the day you look.

Two detectors run over the same resolved set and their findings are merged, so a
record missed by one signature is still caught by the other.

## Pipeline

1. Read the target domains.
2. [subfinder](/tools/subfinder) enumerates subdomains from passive sources.
3. [dnsx](/tools/dnsx) resolves each one and keeps its CNAME chain.
4. [subzy](/tools/subzy) and a [nuclei](/tools/nuclei) takeover template set run
   over the resolved hosts in parallel, each batch distributed across the fleet.
5. Findings from both detectors merge and deduplicate into one report.

## Inputs

- **Target domains.** One root domain per line, such as `example.com`. The
  default is the IANA example domain, so a run you start without editing
  anything points at nothing you would have to explain.
- **subfinder API keys.** Optional config file. Passive enumeration works
  without one, and adding keys widens the set of subdomains that reach the
  takeover checks.
- **nuclei takeover templates.** Pulled fresh at run time. Leave this alone
  unless you keep a private template set you want used instead.
- **Rate limit and concurrency.** Defaults suit a normal perimeter. Lower them
  on targets where a burst of DNS and HTTP requests would be noticed.

## Outputs

- **Dangling records.** Each finding as the subdomain, the CNAME it points at,
  and the fact that nothing answers on the other end.
- **Service attribution.** The vendor behind each dangling CNAME, labelled from
  the can-i-take-over-xyz fingerprint set. This is what tells you whether the
  record is claimable and who to ask for it back.
- **Resolved subdomain inventory.** Every subdomain that resolved, with its
  CNAME chain. You get this even when the takeover count is zero.
- **PDF report.** Both detectors merged and deduplicated into one document,
  with the inventory attached.

## Sample output

From a completed run against `example.com`.

[subfinder](/tools/subfinder) returns the subdomains it can find:

```
www.example.com
m.example.com
dev.example.com
products.example.com
```

[dnsx](/tools/dnsx) resolves each and keeps the record detail the takeover check
needs:

```jsonl
{"host":"www.example.com","ttl":1800,"resolver":["1.0.0.1:53"],"soa":[{"ns":"elliott.ns.cloudflare.com","mailbox":"dns.cloudflare.com"}]}
{"host":"m.example.com","ttl":300,"cname":["m.example.com.cdn.cloudflare.net"],"soa":[{"ns":"elliott.ns.cloudflare.com","mailbox":"dns.cloudflare.com"}]}
{"host":"dev.example.com","ttl":1800,"a":["104.20.23.155"],"soa":[{"ns":"elliott.ns.cloudflare.com","mailbox":"dns.cloudflare.com"}]}
{"host":"products.example.com","ttl":3600,"cname":["products.example.com.herokudns.com"],"soa":[{"ns":"elliott.ns.cloudflare.com","mailbox":"dns.cloudflare.com"}]}
{"host":"legacy.example.com","ttl":600,"cname":["legacy.example.com.s3.amazonaws.com"],"soa":[{"ns":"elliott.ns.cloudflare.com","mailbox":"dns.cloudflare.com"}]}
```

Nothing dangling on this domain, which is the result you want. On a surface that
has been running for a few years, it rarely is.

## FAQ

### How do you check for a subdomain takeover?

Four steps: [subfinder](/tools/subfinder) enumerates the subdomains,
[dnsx](/tools/dnsx) resolves each one and keeps its CNAME chain, the resolved
hosts go through [subzy](/tools/subzy) and the [nuclei](/tools/nuclei) takeover
templates so dangling-service fingerprints get matched from two signature sets,
and whatever is flagged you confirm by hand before calling it claimable: the
provider's registration rules decide that, not the scan. The run names the
dangling record and the service behind it, and that service label ships in the
output rather than a bare verdict. For what a takeover is
and why it is dangerous, see
[DNS takeover explained](/blog/dns-takeover-explained-protect-your-online-domain).
That sequence is exactly what this workflow automates.

### What makes a record dangling?

The CNAME still resolves inside your zone, but the hostname it points at is
unregistered. Anyone who claims that hostname then serves content on your
subdomain, using a name your users and your certificates already trust.

### Why run two detectors over the same hosts?

[subzy](/tools/subzy) and the [nuclei](/tools/nuclei) takeover templates carry
different fingerprint sets, and neither covers every service. Running both and
merging means a record one signature does not know about is still caught by the
other.

### How often should I run this?

On a schedule, weekly or tighter. The gap opens the day a service is
decommissioned, not the day you audit, so the value is in catching the record in
between.

### Does this send traffic to the target?

The enumeration step is passive. The resolve and takeover checks make DNS
queries and HTTP requests to the subdomains themselves, which are hosts in your
own zone.

## Related workflows

- [Subdomain Enumeration](/library/full-subdomain-enumeration). Reach for this
  instead when you need a complete subdomain list first, because dangling
  records only mean something against an inventory you trust.
- [Find Origin IPs Behind Cloudflare](/library/cloudflare-origin-ip-finder-waf-bypass).
  Reach for this instead when the CNAMEs all point at a CDN and the question is
  what sits behind it, not who can claim it.
- [Typosquat and Look-alike Domain Scanner](/library/typosquat-and-look-alike-domain-scanner).
  Reach for this instead when the hostile host uses a name near yours rather
  than one inside your own zone.

---
_Markdown source of https://trickest.com/library/subdomain-takeover-scanner._