Skip to content
DomainGrade

What we checkDNS hygieneDN-05

A subdomain points at something that no longer exists

Whoever claims that target next controls a page on your domain.

Area
DNS hygiene
Check
DN-05
Included
Free in every scan

What we check

One of your subdomains has a CNAME to a hostname that returns NXDOMAIN — the target is gone.

Why it matters

If the target is a hosting service, anyone can sign up and claim that name. From then on they serve whatever they like on your subdomain, with your name in the address bar and a valid certificate.

This is among the most reliably exploited findings in the report, because it is trivial to automate and easy to forget.

Cookies make it worse. Anything scoped to .yourcompany.com is readable from a subdomain an attacker controls, which can turn a forgotten marketing hostname into a session-stealing page on your own domain.

How to fix it

  1. 1

    Delete the DNS record. Do this first — it closes the window immediately.

  2. 2

    Or reclaim the name at the service, if you still want the subdomain.

Common questions

It is only a marketing subdomain.
It is still your domain in the address bar, still in scope for cookies scoped to the parent, and still trusted by anyone who reads the URL.
How quickly could this be exploited?
Automated scanners find these continuously. Assume hours rather than months.
How do I check?
dig blog.yourcompany.com CNAME shows the target; resolving that target shows whether it exists.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other dns hygiene checks