Resources · 115
Dangling subdomains: retire a CNAME without leaving a claimable dependency
Tie each DNS name to a controlled resource and make DNS cleanup part of service retirement.
· 2 min
What this guide helps achieve
- Establish control of the target
- Remove the mapping before releasing the resource
- Close remaining dependencies
Quick check
- Dated name, target, owner and control register.
- Retirement sequence and propagation observations.
- Corrected dependency list and recurring reconciliation.
Step-by-step method
- 01
Establish control of the target
Record public name, CNAME chain, provider resource and owner. Reconcile the DNS zone with the authorized account inventory. An HTTP error, NXDOMAIN or absent target is a finding to investigate, not proof of takeover eligibility; provider protections differ.
Dated name, target, owner and control register.
- 02
Remove the mapping before releasing the resource
For a retiring service, remove the mapping or move it to a destination you control before releasing the resource. Account for previous TTLs and caches; check authoritative DNS and several resolvers. Preserve provider ownership validations that are still needed instead of deleting all TXT records.
Retirement sequence and propagation observations.
- 03
Close remaining dependencies
Check links, redirects, OAuth callbacks, webhooks and cookie domains still using the name. If the target was already released, correct the mapping and investigate possible exposure through the incident process. Reconcile DNS and resource inventories after every deletion.
Corrected dependency list and recurring reconciliation.
Acceptance case to reproduce
Fictional example: these inputs describe no customer or observed result.
View case inputs
{
"name": "portal.example",
"cname_present": true,
"resource_deleted": true,
"provider_claimability": "not_verified",
"takeover_observed": false,
"expected": "remove_or_replace_mapping_and_review_exposure"
}Expected decision
Fictional example: portal.example still points to a deleted resource. Remove the CNAME or replace it with a controlled target; an absent resource alone does not establish that a third party took over the subdomain.
Your acceptance workbook
Record observations against this guide’s criteria. A record is not certification.
The workbook does not save automatically. Export before leaving.
Filters do not limit exports. Actions include issues and unreviewed criteria.
Import replaces current observations after your confirmation.
Management indicators
| Indicator | What it measures | First action |
|---|---|---|
| Mappings without confirmed ownership | Reviewed names without current control evidence | Separate missing resources from incomplete inventory |
| Verified retirements | Retirements with DNS and dependencies checked / reviewed retirements | Keep dates and resolver scope |
Common pitfalls
Frequently asked questions
Does a CNAME pointing to an error page prove the subdomain can be claimed?
No. Confirm resource state and provider reservation or ownership-validation controls. Do not claim a resource to demonstrate the risk.
Official references
References consulted: . The method and worksheet propose checks to adapt to your context; they do not constitute certification.
Continue exploring
Related analysis
