Recon
Diff cloud DNS zones against live inventory for dangling records
findmytakeover is a multi-cloud scanner for dangling DNS records that compares DNS zone records against cloud provider inventory to find entries still pointing at deleted infrastructure, without relying on takeover wordlists.
installpip install findmytakeover
Python · GPL-3.0 license
overview
What findmytakeover does
findmytakeover scans DNS zones and cloud infrastructure you authorize, then reports DNS records whose backing resources no longer exist. It works from inventory, not a subdomain wordlist, so it catches gone buckets, load balancers, and pages that public fingerprint scanners never see.
Point it at a YAML config with --config-file that enables AWS, GCP, Azure, Cloudflare, and/or OCI for DNS and infra collection. With --verify-dns (default on) it also resolves known SaaS takeover fingerprints and treats confirmed NXDOMAIN targets as high confidence. Use --no-verify-dns when you want inventory diff only with no outbound DNS lookups.
On Trickest the Library workflow Multi-Cloud Dangling DNS assembles that config from vault bind scripts, runs findmytakeover, and emits a findings report. Smoke with providers disabled fails closed on missing cloud config instead of inventing a clean multi-cloud result.
use cases
Where findmytakeover fits
Find dangling records after cloud decommissions
Diff each enabled cloud DNS zone against live inventory so records pointing at deleted resources show up as soon as the infra is gone, not when a wordlist happens to guess the name.
Cover AWS, GCP, Azure, Cloudflare, and OCI in one pass
Enable the providers you own in the config file and scan accounts, projects, subscriptions, zones, or compartments in parallel instead of running a separate tool per cloud.
Confirm third-party SaaS takeover candidates
Leave --verify-dns on so fingerprinted SaaS targets (Fastly, GitHub Pages-class suffixes, and others) are resolved. NXDOMAIN confirms high-confidence dangling; wildcarded providers stay in an unconfirmed worklist.
Schedule continuous multi-cloud DNS hygiene
Wire findmytakeover into a Trickest workflow with vault-bound credentials and re-run when accounts or zones change so new dangling records appear as a diff, not a one-off audit.
reference
findmytakeover inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| config-file | FILE | --config-file | findmytakeover YAML config (providers, accounts, credentials, excludes). |
| verify-dns | BOOLEAN | --verify-dns | Resolve third-party SaaS fingerprints to confirm NXDOMAIN dangling records (default on). |
Showing key inputs. findmytakeover exposes 2 inputs in total.
example
Run findmytakeover
# inventory + SaaS NXDOMAIN checks from a provider config
findmytakeover --config-file findmytakeover.config --verify-dns --json findings.json{
"tool": "findmytakeover",
"version": "2.0.0",
"summary": {
"total": 2,
"high_confidence": 1,
"by_target_owner": { "Amazon Web Services": 2 }
},
"findings": [
{
"record": "cdn.example.com",
"target": "gone-cdn.example.com",
"dns_provider": "Amazon Web Services",
"target_owner": "Amazon Web Services",
"dns_status": "nxdomain",
"confidence": "high"
},
{
"record": "legacy.example.com",
"target": "old-bucket.s3.amazonaws.com",
"dns_provider": "Amazon Web Services",
"target_owner": "Amazon Web Services",
"confidence": "inventory-miss"
}
]
}guidance
Choosing findmytakeover
Reach for findmytakeover when you can authorize cloud DNS and inventory APIs and need dangling records across AWS, GCP, Azure, Cloudflare, or OCI. Use subzy or nuclei takeover templates when you only have a public subdomain list and no cloud credentials.
subzy
HTTP fingerprint checks on a subdomain list (can-i-take-over-xyz). No cloud inventory. Pair when you lack vault credentials for findmytakeover.
nuclei
Has takeover templates among many other checks. Useful on public hosts; does not diff cloud DNS zones against live infra.
tko-subs
Providers-CSV takeover detector with optional claim actions. Inventory-free; not a multi-cloud zone diff.
workflows
Workflows using findmytakeover
faq
findmytakeover questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run findmytakeover yourself
Authorized cloud config feeds findmytakeover, which diffs DNS zones against live inventory and emits dangling-record findings.
Facts on this page come from the live Trickest tool library.