What makes a CNAME 'dangling'?

It still points at a service, like a cloud storage bucket or a SaaS instance, that has since been deprovisioned or never claimed, so anyone can now register that service and have your subdomain resolve to their content.

Does this confirm a takeover is actually possible, or just flag candidates?

It flags candidates from DNS-layer signals; confirming a specific service is genuinely claimable still needs a check against that service provider directly before you act.

How many subdomains does it check?

It walks the domain’s full discoverable subdomain estate from the graph’s DNS data, not a fixed short list.

What should I do with a subdomain this flags?

Either reclaim the target service under your own account or remove the dangling DNS record, whichever fits how you’re using that subdomain.

Only in WhisperAttack surface & recon

Which subdomains could an attacker claim right now?

Find subdomains that point at abandoned services an attacker could claim.

Try this in Console

No credit card needed.

What it solves

A subdomain pointing at a deprovisioned cloud service or SaaS instance is an open door: whoever re-registers that service can serve content as if it were yours. Teams that provision subdomains for every new SaaS integration rarely clean up the DNS record when the integration ends, and nothing flags the gap until someone finds it first.

It enumerates the domain’s subdomain estate, checks each CNAME target against known deprovisioned-service patterns, and traces the full delegation chain for anything flagged, so you can see exactly where it points before deciding whether to reclaim the target or remove the record.

The old way3 tools / tabs

Finding dangling subdomains by hand means enumerating every subdomain, checking each CNAME target one at a time, and keeping your own list of what a deprovisioned service’s dead endpoint looks like.

a subdomain enumerator
a CNAME checker run per subdomain
a manually maintained list of dead-service fingerprints

What this means

Give it a domain and it walks its subdomains looking for CNAMEs still pointing at a service that’s since been torn down.
It returns the dangling delegations and their CNAME chains, built entirely from DNS-layer data, so you know exactly which ones to reclaim or remove.

Dig deeper

Key concepts

Read the how-to

What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.

Open the documentation

Why teams run this

The job this flow does, the failure mode it removes, and the proof it produces.

Security leaders

Related flows

All use cases

Faster in Whisper

Attack-Surface Mapper

See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.

Attack surface & reconDocs