Subdomain security scanWhat it checks and how to fix it

What it checks

Resolves a list of common subdomains (www, api, mail, ftp, admin, staging, dev, test, vpn, remote, portal, blog, shop and store) and sends an HTTPS request to each one that has an A record. Passes when every resolving subdomain answers, and warns when one still has a DNS record but no longer responds.

Why it matters

A DNS record that points at a server you no longer run is a dangling record. If the IP address or cloud resource behind it is released and someone else claims it, they can serve content on your subdomain, set cookies for your domain and phish your users under your name, which is known as subdomain takeover. Forgotten staging and admin hosts are also a common way into an organization.

How to fix it

For each subdomain reported, decide whether the service still exists:

• Decommissioned: delete the DNS record (A, AAAA or CNAME) for it.
• Still needed: bring the service back up, or restrict it to a VPN or an IP allowlist instead of leaving a public record that does not answer.

dig +short A staging.example.com
curl -sI https://staging.example.com

Also review CNAMEs pointing at third-party services (cloud storage buckets, PaaS apps, GitHub Pages, help desks): remove the record before you delete the resource it points to, never after.