Free Subdomain Takeover Checker
Free tool
Scans your DNS for dangling CNAMEs and known provider takeover fingerprints (Heroku, S3, GitHub Pages, and more) so you can reclaim them before attackers do.
- Orphaned CNAMEs
- Provider fingerprints
- Takeover indicators
No credit card requiredProduction-safe (100% passive)No setup or code required
Trusted by 3,500+ security & engineering teams
What you get for free
18 core security checks via this tool, passive scans, step-by-step remediation, security score on every result.
What Essential adds at $39/mo
+17 advanced checks, continuous monitoring, daily security score history, email alerts, GitHub SAST, board-ready PDFs, SOC 2 / ISO 27001 / PCI reports.
How to prevent takeovers
- Remove stale CNAMEs/ALIAS records
- Use provider verification and auto-cleanup
- Continuously monitor DNS changes
What is subdomain takeover?
When a DNS record points to a deprovisioned resource (like an unused SaaS hostname), attackers can claim it and serve content under your subdomain.
Implementation examples
Once you've identified a dangling CNAME, the fix is to remove or repoint the record at your DNS provider. Here are the three surfaces developers reach for most often.
BIND zone file
; Remove the dangling CNAME pointing to a deprovisioned SaaS host
; Before:
; old-app IN CNAME myapp.herokudns.com.
;
; After: delete the record entirely, then bump the SOA serial
@ IN SOA ns1.example.com. hostmaster.example.com. (
2026060101 ; serial (yyyymmddnn)
3600 600 1209600 300 )Cloudflare API
# Delete a dangling CNAME via the Cloudflare API
curl -X DELETE \
"https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
-H "Authorization: Bearer $CF_API_TOKEN" \
-H "Content-Type: application/json"AWS Route 53
# change-batch.json
{
"Changes": [{
"Action": "DELETE",
"ResourceRecordSet": {
"Name": "old-app.example.com.",
"Type": "CNAME",
"TTL": 300,
"ResourceRecords": [{ "Value": "myapp.herokudns.com." }]
}
}]
}
aws route53 change-resource-record-sets \
--hosted-zone-id Z123456ABCDEFG \
--change-batch file://change-batch.jsonTool-specific questions
Which providers are commonly abused?
Static hosting, CDN, and SaaS providers where resources can be reclaimed by other users. Keep your inventory up to date.
Can wildcard DNS cause issues?
Yes. Wildcards can mask stale records and broaden risk. Prefer explicit records.
How do I detect stale CNAMEs?
Maintain a DNS inventory, scan for providers' known takeover fingerprints, and remove records pointing to deprovisioned resources.
Why Barrion
Built for the engineers who already have enough to fix.
Speed
Real-time results
Instant analysis with a detailed report. You see findings as the scan runs, not after.
Coverage
Comprehensive checks
35+ checks per scan covering TLS, headers, CORS, cookies, DNS, email auth, and more, in a single pass.
Action
Step-by-step fixes
Every finding ships with the exact remediation step for your framework. Hand it to the engineer who owns the surface.
Other tools
More free checks, for the rest of your surface.
Complete Security Scan
Complete website security analysis with comprehensive vulnerability detection
Pre-Pentest Security Scan
Passive scan that catches the misconfigurations a pentester finds first. Use it before a manual engagement to clear the easy issues.
Security Compliance Checker
Check compliance with PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR. Get compliance readiness reports.
WAF Checker
Detect Web Application Firewall presence through passive header analysis. Identify WAF/CDN providers.
Security Headers Test
Check your website's HTTP security headers configuration
TLS/SSL Security Checker
Validate your SSL/TLS configuration and certificate setup
Related guides
Go deeper on the same topic.
FAQ
Frequently asked.
What is Barrion and how does it enhance website security?
Barrion is a security testing and monitoring platform for engineering teams, covering three products: passive DAST that continuously watches your live web apps and APIs, SAST via GitHub that scans your codebase for secrets, insecure patterns and vulnerable dependencies, and AI pentesting that runs active, agent-driven attacks with proof-of-exploit. Findings come with step-by-step fixes you can ship immediately.
How safe is Barrion to use for security testing?
Every default Barrion scan is 100% passive and read-only. We never submit forms, brute-force endpoints or interact with state-changing routes, so it's safe to run against production.
What types of security issues does Barrion identify?
Barrion is a security testing and monitoring platform, so coverage spans three surfaces. Passive DAST flags misconfigurations across TLS/HTTPS, security headers, cookie flags, CORS policy, DNS records, email authentication (SPF/DKIM/DMARC), network exposure and common web hygiene issues. SAST via GitHub finds secrets in code, insecure patterns and vulnerable dependencies. AI pentesting adds exploitable findings like SQL injection, XSS and broken access control with proof-of-exploit.
What specific security checks does Barrion perform?
Barrion checks TLS/HTTPS configuration, HTTP security headers, cookie flags, CORS policy, DNS and email authentication records, network exposure and common web hygiene issues, then prioritises them by severity with clear remediation.
What is Barrion's smart crawling?
Smart crawling automatically discovers the pages and endpoints of your app so scans cover the surface that matters, without you manually listing every URL.
How often does Barrion perform security scans?
Manual scans on demand. Continuous monitoring runs automatically on Essential (weekly+) and Business (daily), and alerts you the moment a new issue appears.
Is Barrion suitable for security testing of all business sizes?
Yes. Barrion is a security testing and monitoring platform, with passive DAST, SAST via GitHub and AI pentesting available to solo developers, startups, scale-ups and enterprise security teams alike, without adding headcount.
How does Barrion handle data security and privacy during security testing?
Scans are passive and read-only by default, and we never store or expose sensitive data from your application. Pentests are rate-limited and non-destructive, designed to confirm exploitability without altering data or affecting availability.
What if I'm not satisfied with Barrion's security testing service?
Paid plans start with a free trial, and you can cancel anytime. If something isn't right, contact us and we'll make it work for your team.
How does Barrion help with SOC 2, ISO 27001, NIS2, and other compliance frameworks?
Barrion produces audit-ready PDF and CSV reports suitable for SOC 2, ISO 27001, PCI DSS and NIS2, ready to share with auditors, customers and your board.
Anything else? Email contact@barrion.io.
Run a full report on your site.
Free first scan covers every check, no signup needed. Sign up to save the report and turn on continuous monitoring.