Subdomain takeovers are a common threat for any organization with extensive domain and DNS holdings. On a basic level, they enable threat actors to redirect traffic intended for an organization’s domain, to a site performing malicious activity.

Takeovers occur when a DNS record points to a deprovisioned resource - such DNS records are also known as dangling DNS entries.

CNAME records are of particular importance in subdomain takeovers, given their ability to map hostnames together, and delegate IP resolution.

Searching for dangling DNS records

Silent Push pre-aggregates global DNS data, and flags any records that are considered to be dangling, on a weekly basis.

We achieve this by collecting all current CNAME, MX or NS records and subtracting all current A and AAAA records – the remaining CNAME, MX and NS records are then searchable on the platform.

We’ve also programmed an optional live check (enabled by default) to confirm the current dangling state of all results returned by the API.