Glossary
What Is a Dangling CNAME?
Published Last updated
A dangling CNAME is an alias record still pointing at a target that no longer exists. The record resolves to nothing — and to whoever claims the target next.
A CNAME record makes one hostname an alias for another: docs.example.com is a CNAME to a hosting provider, and the provider answers for it. The record is dangling when the target stops existing — the hosting account is closed, the bucket is deleted, the SaaS trial lapses — while the CNAME stays in the zone.
Nothing breaks loudly. The hostname just stops resolving, which reads as a dead link rather than an exposure. The exposure is that the target is now claimable: on most platforms the next account to ask for that subdomain name gets it, and with it every request the dangling CNAME is still sending. That is a subdomain takeover, and the dangling CNAME is how it starts.
WhisperGraph models CNAME as the ALIAS_OF edge between two hostnames, alongside RESOLVES_TO for the addresses each side actually has. A dangling alias is the pattern where ALIAS_OF has a target and that target has no resolution — one query across two edge types, over a corpus that already holds the subdomains.
See it in practice
Run it live: Find subdomain takeover exposure.
Workflows that use this
Runnable workflows where this concept does the work.
Subdomain Takeover Detection
A dangling subdomain, one still pointing at a service you've since torn down, is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.
