Subdomain Takeover

What It Does

Walks the CNAME chain for each candidate (up to 8 hops, so `www → cdn.example.com → dangling.s3.amazonaws.com` is detected). For each terminal target, matches against the fingerprint table, then probes HTTPS and runs body regex matching to confirm the service is unclaimed. Falls back to A-record check when no CNAME is present. Returns per-candidate status with the full cname_chain, matched service, evidence, remediation steps, and a per-service remediation_link.

Why It's Useful

Subdomain takeover is a low-sophistication, high-impact attack that persists for months or years after infrastructure deprovisioning. Teams forget that a blog.example.com CNAME still points to a cancelled Heroku app — until an attacker registers that app name and suddenly hosts malware under the legitimate brand. Automated detection catches these dangling CNAMEs during DNS audits rather than during an incident.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/domain/subdomain-takeover" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=example.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/domain/subdomain-takeover?domain=example.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/domain/subdomain-takeover',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'example.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.