Old DNS records can hand over your subdomain
A DNS record pointing to a cloud service you deleted lets someone else claim it, and serve pages under your name.
You set up promo.example.com pointing to a cloud app or a storage bucket. The campaign ends, someone deletes the app, but the DNS record stays. Anyone who creates an app with the same name on that service now controls a page on your domain.
That’s subdomain takeover. It’s used for phishing pages that look completely legitimate, and sometimes to steal cookies set for your whole domain.
- Export your DNS zone and look at every CNAME pointing to a cloud provider, CDN, help desk or landing-page tool.
- Open each one. An error like “no such app”, “bucket does not exist” or a provider’s default page is a red flag.
- Delete records for things that no longer exist.
- Make it a rule: when a service is shut down, its DNS record is removed the same day.
DNS is easy to add and easy to forget. Review it every few months.