Enter your domain and Nameward finds its subdomains in public Certificate Transparency logs, looks each one up in DNS, and flags any whose CNAME record points at a cloud resource that no longer exists. Those dangling records are how subdomains get taken over: whoever recreates the missing resource serves their own pages on your subdomain.
How to read the results
Dangling records appear at the top of the certificates section:
- Act now: the record points at a missing resource on a service where anyone can claim the name, such as Azure App Service, Azure Traffic Manager, Azure Blob Storage or AWS Elastic Beanstalk. Delete the record today, or recreate the resource.
- Watch: the record points at a name that doesn't exist on a service we can't claim from. It's harmless now but worth removing before the target name becomes available.
What it doesn't catch
The check works from DNS. Services that keep answering after a resource is deleted, such as Amazon S3 buckets and GitHub Pages, show an error page instead of disappearing, and need an HTTP check to spot. Subdomains that never had a public certificate aren't in the logs, so check your DNS zone for those too.