Is your DNS delegation an open door to hijacking?
Check a domain's name servers for the misconfigurations that enable DNS hijacking.
No credit card needed.
What it solves
A domain’s name servers decide where every request for it ends up, and a stale or inconsistent delegation is exactly the kind of gap that enables a hijack. Most teams never audit their own delegation until something has already gone wrong, because doing it by hand means checking each name server one at a time against the registry record.
It reads the domain’s name server records, compares them against the registry’s own delegation record, flags any name server whose estate looks abandoned or exclusive to a single stale provider, and pulls the TLD registry operator so you can see who ultimately controls the parent zone.
Auditing a delegation by hand means looking up every name server individually and cross-referencing it against the registry record, one nameserver at a time.
- a dig/whois check per nameserver
- the TLD registry’s WHOIS lookup
- manual notes on what each provider actually handles
What this means
- Give it a domain and it checks every name server in its delegation for staleness, mismatches and registry-level red flags.
- It returns a delegation audit, sizing how much traffic each provider actually handles, built entirely from DNS-layer data.
Dig deeper
Key concepts
Read the how-to
What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.
Open the documentationWhy teams run this
The job this flow does, the failure mode it removes, and the proof it produces.
Security leadersRelated flows
All use casesThreat Investigation
The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'
Attack-Surface Mapper
See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.
Subdomain Takeover Detection
A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.