# What Is a Dangling CNAME?

> A dangling CNAME is an alias record still pointing at a target that no longer exists. The record resolves to nothing — and to whoever claims the target next.

*Source: https://www.whisper.security/glossary/dangling-cname*
*Published: 2026-09-20*
*Last updated: 2026-09-20*

---

A CNAME record makes one hostname an alias for another: docs.example.com is a CNAME to a hosting provider, and the provider answers for it. The record is dangling when the target stops existing — the hosting account is closed, the bucket is deleted, the SaaS trial lapses — while the CNAME stays in the zone.

Nothing breaks loudly. The hostname just stops resolving, which reads as a dead link rather than an exposure. The exposure is that the target is now claimable: on most platforms the next account to ask for that subdomain name gets it, and with it every request the dangling CNAME is still sending. That is a subdomain takeover, and the dangling CNAME is how it starts.

WhisperGraph models CNAME as the ALIAS_OF edge between two hostnames, alongside RESOLVES_TO for the addresses each side actually has. A dangling alias is the pattern where ALIAS_OF has a target and that target has no resolution — one query across two edge types, over a corpus that already holds the subdomains.

## See it in practice

Run it live: [Find subdomain takeover exposure](/products/intelligence/use-cases/attack-surface-recon/subdomain-takeover).