# Subdomain takeover checker

Enter your domain and Nameward finds its subdomains in public Certificate
Transparency logs, looks each one up in DNS, and flags any whose CNAME
record points at a cloud resource that no longer exists. Those **dangling
records** are how subdomains get taken over: whoever recreates the missing
resource serves their own pages on your subdomain.

## How to read the results

Dangling records appear at the top of the certificates section:

- **Act now**: the record points at a missing resource on a service where
  anyone can claim the name, such as Azure App Service, Azure Traffic
  Manager, Azure Blob Storage or AWS Elastic Beanstalk. Delete the record
  today, or recreate the resource.
- **Watch**: the record points at a name that doesn't exist on a service we
  can't claim from. It's harmless now but worth removing before the target
  name becomes available.

## What it doesn't catch

The check works from DNS. Services that keep answering after a resource is
deleted, such as Amazon S3 buckets and GitHub Pages, show an error page
instead of disappearing, and need an HTTP check to spot. Subdomains that
never had a public certificate aren't in the logs, so check your DNS zone
for those too.

## Related

- [Subdomain takeover: how dangling DNS records get hijacked](/guides/subdomain-takeover)
- [Find all SSL certificates for a domain](/tools/find-ssl-certificates)
- [SSL certificate expiry checker](/tools/ssl-expiry-checker)

---
Source: https://nameward.app/tools/subdomain-takeover-checker (updated 2026-10-30)