Free Subdomain Takeover Checker
Find dangling DNS records vulnerable to takeover
Enter a domain to discover subdomains via certificate transparency logs, then check each one for dangling CNAME records pointing to unclaimed services like GitHub Pages, Heroku, S3, Azure, and more. A dangling CNAME means an attacker could register the target service and serve malicious content on your subdomain.
Trusted by teams at
How it works
How Subdomain Takeover Checker works
Enter your domain
Type any domain name. We'll enumerate its subdomains using certificate transparency logs — a passive technique that doesn't touch the target's servers.
Check CNAME records
For each discovered subdomain, we query DNS for CNAME records and check whether they point to known cloud services that could be claimed by an attacker.
Identify takeover risks
Subdomains with dangling CNAMEs are flagged with the affected service and risk level. You get specific remediation steps for each vulnerable subdomain.
Features
What Subdomain Takeover Checker checks
Enumerate subdomains passively
Discovers subdomains via certificate transparency logs without sending any traffic to the target domain. This reveals subdomains that may have been forgotten or decommissioned.
Detect dangling CNAME records
Queries DNS for CNAME records and identifies those pointing to services that are no longer configured — the key indicator of a subdomain takeover vulnerability.
Check major cloud service providers
Tests for dangling references to GitHub Pages, Heroku, AWS S3, Azure, Shopify, Fastly, Pantheon, Tumblr, and other services known to be vulnerable to subdomain takeover.
Verify service availability
For flagged subdomains, attempts to fetch the URL to confirm the service returns an error or default page — distinguishing between active services and truly dangling references.
Use cases
Who should use the free Subdomain Takeover Checker
Security Teams
Regularly scan your organization's domains for dangling DNS records. Subdomain takeovers are high-impact, easy-to-exploit, and frequently overlooked in security programs.
Bug Bounty Hunters
Quickly check a target's subdomain footprint for takeover vulnerabilities. Subdomain takeovers are one of the most commonly reported and rewarded bug bounty findings.
DevOps Engineers
Verify that DNS cleanup happens when decommissioning services. A forgotten CNAME after shutting down a Heroku app or S3 bucket creates an immediate takeover risk.
More tools
All free security tools
Scanners
(9)Checkers
(7)Decoders & Generators
(3)FAQ
Frequently asked questions
Everything you need to know about the free Subdomain Takeover Checker.
Go beyond Subdomain Takeover Checker
This free Subdomain Takeover Checker checks a handful of things. Maced's AI pentest checks thousands.
Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.
Proof of exploit on every finding · SOC 2 & ISO 27001 compatible