Platform
Dangling DNS and subdomain takeover risk
A subdomain takeover happens when your DNS still points at a cloud resource you deleted, and someone else claims it. They can then serve pages, collect credentials or send mail on a name your customers trust. EASMLens flags CNAME records whose targets no longer resolve so your team can remove or reclaim them first.
Cleaning up the cloud resource is only half the job
Teams decommission a cloud app, a storage bucket or a hosted page and forget the DNS record that pointed at it. The record now refers to a name anyone can register on the same platform. Whoever registers it controls content on your subdomain.
These records accumulate in large estates, especially after migrations and marketing campaigns, and they rarely appear in change tickets because nothing was changed in DNS.
How EASMLens does it
- 1
Enumerate subdomains
Discovery finds subdomains from DNS and certificate transparency, including old ones no longer linked anywhere.
- 2
Follow CNAMEs
Each CNAME chain is followed to its target, and targets that do not resolve to an address are flagged as possible dangling records.
- 3
Report with context
The finding shows the subdomain, the CNAME target and when it was seen, so the DNS owner can act without a second investigation.
- 4
Confirm closure
Once the record is removed or the resource reclaimed, the next scan closes the finding.
What it checks
Unresolvable CNAME targets
Records pointing at names that return no address.
Forgotten subdomains
Names found in certificate transparency that are no longer in active use.
Hosting changes
Subdomains that moved hosting network or location between scans.
Certificate gaps
Subdomains with expired or missing certificates, often a sign of abandonment.
What you get
- Possible dangling CNAME findings with record, target and first-seen date
- A clean list for the DNS owner of records to delete or resources to reclaim
- Automatic closure once the record no longer dangles
Where it helps
- Brand protection
- Stop attackers serving phishing pages on a subdomain your customers already trust.
- After migrations
- Catch the records left behind when applications move between cloud providers.
- Board reporting
- A concrete, fixable risk that shows the value of continuous discovery.
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Does EASMLens confirm that a subdomain can be taken over?
- No. It flags CNAME records whose targets do not resolve, which is the precondition for most takeovers. Whether a specific provider lets someone claim that name depends on the provider, so each finding is marked for verification. EASMLens never attempts the takeover.
- What should we do with a finding?
- If the service is gone for good, delete the DNS record. If you still need the name, reclaim the resource on the provider before anyone else does.
- Why are these missed by normal vulnerability scanners?
- Scanners test hosts you point them at. A dangling record often points at nothing that answers, so it never appears in a host-based scan. Finding it needs DNS-level discovery.
Related capabilities
Attack surface discovery
Find every internet-facing domain, subdomain, IP, certificate, cloud service and API attributed to you, including shadow IT nobody told security about.
Email security monitoring
Monitor SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC, DANE and BIMI across every domain you own, including parked domains attackers spoof.
Certificate and website monitoring
Catch expired and expiring TLS certificates, sites still on plain HTTP and website quality issues across every web asset you own, not just the main site.