# Subdomain Takeover Detection

> A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.

*Source: https://www.whisper.security/docs/workflows/subdomain-takeover*

---
## How it uses the graph

Traverses the DNS layer of the graph, in 3 steps:

01. **Subdomain estate** _(DNS)_ — Enumerating the subdomain estate…
02. **Dangling CNAMEs** _(DNS)_ — Flagging CNAMEs whose target no longer resolves…
03. **CNAME delegation chains** _(DNS)_ — CNAME delegation chains…

## Why each step runs

1. **Subdomain estate.** The estate is the candidate set for dangling references.
2. **Dangling CNAMEs.** A CNAME to a non-resolving target is the takeover signature (prod-ahead ALIAS_OF layer).
3. **CNAME delegation chains.** Traces each subdomain's full CNAME delegation chain (up to 5 hops) and flags chains whose final target no longer resolves to an IP — the dangling endpoint a takeover would hijack.

## Key concepts

- [Subdomain takeover](/glossary/subdomain-takeover)
- [Dangling CNAME](/glossary/dangling-cname)

[Open the full use-case page, with the live runner](/use-cases/attack-surface-recon/subdomain-takeover)