Remove or reclaim the CNAME to a deprovisioned service

Why it matters

A subdomain's CNAME points at a hosted service where your account or resource no longer exists, so someone else could claim it and serve their content on your subdomain. That can be used for phishing, malware or stealing cookies.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find the CNAME in the DNS zone, using the name from the finding.
2. If the subdomain is no longer needed, delete the DNS record. This is the safest fix and takes effect as soon as the record's TTL runs out.
3. If you still need it, recreate the resource at the service (the bucket, site, app or project) under your own account and make sure it serves the right content, or point the record somewhere you control. If you cannot recreate the resource right away, delete the record first and add it back once the resource exists again.
4. Check whether the subdomain was already taken over. Open it in a browser, look for content you did not put there, and check for cookies scoped to the parent domain, which a takeover could read.
5. Look for other records that point at the same service, and review all CNAMEs in the zone for resources that no longer exist.
6. Add a rule to your decommissioning process, so DNS records are removed before the resource is deleted.

# replace sub with the subdomain named in the finding
dig CNAME sub.example.com +short

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Dangling CNAMEs check
• Delete the CNAME that points at an unregistered domain
• Move the CNAME to an internal name out of public DNS
• Delete the CNAME that points at a name that does not exist
• Fix the wildcard CNAME that points at a missing name