Free Subdomain Takeover Checker
Find the subdomains of a domain in public certificate logs, follow each CNAME to its target, and see which records point at a service that no longer answers. Runs in your browser.
Three steps from a forgotten record to someone else's page on your domain
A takeover needs no exploit. It needs a CNAME you forgot, a service that gives names away, and someone who registers yours before you remove the record.
Discover
Certificate logsEvery certificate ever issued for a name under your domain is public. The checker reads them to find the subdomains, including ones nobody remembers.
Resolve
Where the CNAME pointsEach name with a CNAME is followed to its target. A target that no longer exists is a dangling record, a door left in your DNS.
Match
Known takeover servicesA dangling target at GitHub Pages, Heroku, S3, Azure, Netlify and the other services that hand out names is claimable by whoever registers it first.
Every subdomain, every scan, with the fingerprint checked.
FortWatch finds every subdomain of the domains you own, follows each CNAME, fetches the target over HTTP and matches the service's own takeover fingerprint, so a claimable name is confirmed, not guessed. Every scan watches for new dangling records.
- Subdomain discovery from certificate logs and DNS, on every domain you own
- The takeover fingerprint checked over HTTP, with severity by the service
- An alert the moment a new dangling CNAME appears
Common questions about subdomain takeover
What is a subdomain takeover?
▾
A subdomain of yours, say shop.example.com, points by CNAME at a hosting service, say a Shopify store or a GitHub Pages site. The project behind it is deleted, but the DNS record stays. Anyone who registers that name at the service now answers for your subdomain: they serve pages under your domain, read cookies scoped to it, and pass as you in phishing mail.
What is a dangling CNAME?
▾
A CNAME record whose target no longer exists. The checker resolves each CNAME target it finds; a target that returns NXDOMAIN is dangling. When the target also belongs to a service that lets anyone register names, the record is claimable, which is the takeover case.
Where does the checker get the subdomains from?
▾
From public certificate transparency logs, through crt.sh: every certificate ever issued for a name under your domain is recorded there. So only names that had a certificate are checked, and a name that never had one is not seen. The first 100 names are checked; a domain with more gets a note saying so.
What does claimable mean, and is it proof of a takeover?
▾
No. Claimable means the CNAME target does not resolve and belongs to a service known for takeovers. It is a finding to verify: the service may still hold the account, or may check domain ownership before serving a custom hostname, as GitHub Pages, Heroku, Netlify, Shopify and others do. The fix is the same in every case: remove the record or point it at something you run.
How do I fix a dangling CNAME?
▾
Delete the CNAME record if the service is gone, or recreate the project at the service under the same name so the target exists again. Then check the name here once DNS has propagated. For the names that stay, keep an inventory of which subdomain points at which service, and remove the record on the same day the service is cancelled.
How does this checker work, and is it free?
▾
It reads the certificate logs through crt.sh and the DNS records through Cloudflare's public DNS over HTTPS, straight from your browser, and matches each CNAME target against the list of services the FortWatch scanner knows. Nothing is sent to our servers, nothing is logged, and no request is made to the subdomains themselves. It is free, with no signup.
Try another tool
DMARC & SPF Checker
Check any domain's SPF, DMARC, and DKIM records. Catch what spoofers can exploit.
SPF Record Checker
Any domain's SPF record: policy, lookup count against the limit of 10, authorized senders.
DKIM Checker
The DKIM key of any domain at its selector or the common ones, with the public key checked.
DNS Lookup
A, AAAA, MX, NS, TXT, CNAME records for any domain — direct from Cloudflare 1.1.1.1.
Subdomain Finder
Find every subdomain a domain has ever issued a certificate for via Certificate Transparency logs.
Security Headers Checker
Grade any site's HTTP security headers — missing, weak, and what your server leaks.
CAA Record Checker
Which certificate authorities a domain allows to issue its certificates, and what to publish when none is set.
DNSSEC Checker
Whether a domain is signed and validated: DS at the parent, the DNSKEY set, the chain resolvers accept.
security.txt Checker
A site's security.txt checked against RFC 9116: contact, expiry, canonical address, signature.