Checks the CNAMEs of subdomains found in CT logs and detects dangling DNS records that attackers could abuse to take a subdomain over.
The Subdomain Takeover Scanner finds subdomains whose CNAME still points at a cloud service resource that no longer exists, or at an unregistered domain (dangling DNS). Anyone can then create a resource with the same name and take the subdomain over — enabling phishing and cookie theft under your domain. Free, no sign-up.
Subdomains are collected from Certificate Transparency logs (crt.sh / certspotter) and checked using public DNS responses only. The tool never fetches the target's web pages and never attempts an actual takeover.
| Verdict | Meaning |
|---|---|
| Critical | The CNAME target does not exist and either belongs to a service whose names can be re-claimed (Azure, AWS Elastic Beanstalk, …) or sits under a domain that appears to be unregistered. High takeover risk. |
| Warning | The CNAME target does not exist. Most likely a forgotten record — remove it. |
| Verify | Points at a service such as GitHub Pages, S3 or Heroku that keeps resolving after the resource is deleted. DNS alone cannot tell whether it is claimable — open the host in a browser and look for "Not Found"-style error pages. |
Limitations
• Only subdomains recorded in CT logs are covered (subdomains without HTTPS or internal-only hosts are not).
• Up to 100 subdomains are scanned; larger domains are scanned partially.
• Verdicts come from DNS alone, so "Verify" never proves a subdomain can be taken over.
• "Critical" and "Warning" are inferences from public DNS state, not proof of exploitability.
What is a subdomain takeover?
If a subdomain's CNAME still points at a deleted cloud resource, a third party can create a resource with the same name at that provider and serve their own content on your subdomain. That enables phishing that borrows your domain's trust and cookie theft against the parent domain.
Many subdomains show "Verify". Are they all dangerous?
No. Most are simply using GitHub Pages, CloudFront and the like correctly. The label is a prompt to open the host in a browser and make sure the resource still exists.
Is it OK to scan someone else's domain?
The tool only reads public information (public DNS and CT logs). Still, handle results responsibly — abusing a finding is prohibited.
The scan is slow.
On top of the CT log lookup, every subdomain is queried in DNS, so the first run can take 10–30 seconds. Results for the same domain are cached for 1 hour.