Find forgotten subdomains before someone else does
Old subdomains pile up: a campaign site, a staging app, a docs host. When one still points (by CNAME) at a service that no longer exists, someone else may be able to claim that service and serve content on your name. The free Investigate tool lists subdomains from certificate transparency logs and checks them for exactly this.
What to monitor on Subdomain takeover
- 01Subdomains from certificate logsNames that have appeared on public TLS certificates, found via certificate transparency.
- 02Does it resolve?Whether each subdomain still has DNS records.
- 03HTTPS status and timeWhat each subdomain returns over HTTPS and how long it takes.
- 04Dangling CNAMEsCNAMEs pointing at targets that no longer resolve are flagged as subdomain-takeover risks.
Set it up
Investigate your domain
Open statance.com/tools/investigate and enter your domain. Subdomains appear in their own section.
Check them
Use the “?” next to any subdomain, or “Check the first 50”, to see which resolve, their HTTPS status and response time, and any dangling CNAMEs.
Fix or remove risky records
Delete CNAMEs that point at services you no longer use, or reclaim the target.
Keep watching what remains
One click adds a subdomain uptime monitor, or a DNS monitor that alerts if a CNAME record stops matching.
Recommended alerts for Subdomain takeover
- Subdomain stops responding (subdomain uptime monitor)
- CNAME record no longer matches the expected value (DNS monitor)
Send alerts to
Email
Slack
WebhooksSubdomain takeover FAQ
Is the subdomain check free?
Yes. Subdomain discovery and the “?” / “Check the first 50” checks are part of the free Investigate tool. Monitors need a Statance account; the free plan works.
Will it find every subdomain?
No. Certificate transparency only shows names that have appeared on public certificates. Subdomains that never had their own certificate (or only use a wildcard) won’t be listed.
Does a flagged CNAME mean I have been taken over?
No. It means the record points at a target that no longer resolves, which is a takeover risk worth fixing. Confirm the record is unused, then remove or update it.