How to Find Dangling CNAMEs Before Someone Takes Over Your Subdomain

A dangling CNAME is a record that still points one of your subdomains at a service you've stopped using. Paste every hostname you know about into the bulk CNAME lookup and filter to the rows marked Dangling: those CNAMEs point at a name that no longer resolves. Remove them, or point them at something you control.

Look up CNAMEs for a list of hostnames →

Find them in bulk

1. List your hostnames: www, shop, blog, help, status, tracking domains, old campaign sites. Your DNS host's zone export is the most complete source.
2. Open the bulk CNAME lookup and paste them, one per line: up to 100 a run, or 500 after a free Google sign-in. URLs work too.
3. Press Look up CNAMEs. Each chain is followed hop by hop, up to eight.
4. Read each row: Alias (resolves), Dangling (target doesn't resolve), No CNAME, Doesn't exist or Loop.
5. Filter to Dangling and Doesn't exist, and download the CSV with the full chain.

Do it by hand

printf "www.github.com\nwww.mozilla.org\ndocs.github.com\nnope-1109.mozilla.org\n" > hosts.txt

while read -r h; do
  out=$(dig +noall +comments +answer "$h" a)
  st=$(echo "$out" | grep -o 'status: [A-Z]*' | cut -d' ' -f2)
  cn=$(echo "$out" | awk '$4=="CNAME"{print $5}' | tail -1)
  echo "$h,${cn:-no CNAME},$st"
done < hosts.txt
# www.github.com,github.com.,NOERROR
# www.mozilla.org,www-mozilla.fastly-edge.com.,NOERROR
# docs.github.com,no CNAME,NOERROR
# nope-1109.mozilla.org,no CNAME,NXDOMAIN

We ran this on 9 November 2026. None of these is dangling, which is what you'd hope from public sites. A dangling row would show a CNAME and NXDOMAIN: the alias exists, its target doesn't. You can see what a missing target answers by querying one directly:

dig +noall +comments sv-nonexistent-1109.azurewebsites.net | grep -o 'status: [A-Z]*'
# status: NXDOMAIN

Where DNS alone isn't enough

Some platforms answer for every name under their domain. On the same day, made-up names under github.io and herokuapp.com both returned NOERROR with addresses, and https://sv-nonexistent-1109.github.io/ answered 404. A CNAME pointing at a deleted site on such a platform still resolves, so neither a dig loop nor the bulk CNAME lookup can call it dangling.

For hostnames that point at a hosting platform, also open them over HTTPS. A platform's "no site here" or 404 page on your hostname means the target is gone. The bulk CNAME lookup's limits say the same: Dangling means "the target doesn't resolve now", and it doesn't test whether someone else can claim it.

Why it matters, and how to stop it happening

MDN's page on subdomain takeover describes the risk: if you take a service down but "don't remove the DNS entry that points to the hosting provider, an attacker can now create their own virtual host with that provider, claim your subdomain, and host their own content under that subdomain."

Its prevention advice is about order:

• When setting up a service, claim it at the provider first and "create DNS records last".
• When taking one down, start by "removing DNS records first".
• Keep an inventory of your domains and their hosting providers, so nothing is left dangling.

For email, the common case is a custom tracking domain left behind after you cancel a cold email tool: every tracked link in mail already sent then breaks. See custom tracking domains for cold email.

Next step: check the addresses on your list

Clean DNS keeps your links and brand safe. Bounces from dead addresses are a separate problem that hurts your sending reputation. Upload your list at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

More: audit every domain your company owns, find where to edit a domain's DNS.