Can someone take over your subdomains?
Only if a DNS record points at something that's gone. Here's how that happens, how to check, and how to fix it.

Someone else serving content on one of your subdomains, because its DNS record points at something that no longer exists. You point shop.example.com at an app on a hosting service, later delete the app but leave the record. Anyone can then create an app with that name on the same service, and the service hands them shop.example.com.

The same, one level up: someone gets to answer DNS for your whole domain. It happens when a nameserver your domain uses sits on a domain nobody renewed. Whoever registers that domain answers for yours: its website, its email, and new certificates for it.

Almost always through a record nobody cleaned up.

• A CNAME to a deleted app, site or bucket, such as shop.example.com → na-west1.surge.sh after the Surge project is gone.
• A CNAME to a host whose domain has expired. Anyone can register the domain, and with it the target.
• An NS record on a nameserver domain that expired, often an agency's or an old host's.
• An MX record to an old mail host whose domain lapsed: whoever registers it receives your mail, including password resets.
• An A record to a cloud server you shut down. The address goes back to the provider and on to the next customer.

Anything the real site could: put up a login page on your name, read cookies set for the parent domain, get a certificate issued for the name, and send or receive email that passes your own checks.

SubdoMailing, 2024

Guardio Labs found a spam operation that had taken over more than 8,000 domains and 13,000 subdomains of well-known brands, among them a subdomain of msn.com. Many were CNAME records pointing at domains that had expired; the spammers registered those domains and sent millions of emails a day that passed the brands' own SPF checks.

Sitting Ducks, 2024

Eclypsium and Infoblox showed that a domain whose nameservers don't hold its zone can be claimed at some DNS providers by whoever creates the zone first. They estimated about a million domains were exposed and confirmed more than 30,000 taken over since 2019.

Type it in the box at the top of this page. The free domain health report looks at the domain's nameservers, mail servers and addresses, and the CNAMEs of common subdomains (www, mail, shop, blog, app, docs, status, help, cdn, api). For a CNAME that still resolves, it asks the subdomain for its home page and compares the answer with the service's own "nothing here" page.

Either delete the record, or create the resource again so it's yours. If nothing should be at that name, delete the record at your DNS host. If something should, re-create the app, site or bucket with the same name and add the subdomain to it as a custom domain. For an expired nameserver or mail domain, change the record to servers you use today, or renew that domain if it's yours.

Where nmspc knows the service, it says exactly what to create. Today that is:

AWS Elastic Beanstalk

In AWS Elastic Beanstalk, create an environment with this CNAME prefix again, in the region the record names. Or delete the record.

AWS S3

In AWS S3, create a bucket named exactly after this host, in the region the record names, and turn on static website hosting. Or delete the record.

Bitbucket

In Bitbucket, create the <workspace>.bitbucket.io repository again. Or delete the record.

Ghost

In Ghost(Pro), add this host as the custom domain of your site again. Or delete the record.

Help Scout

In Help Scout, set this host as the Docs site's custom domain again. Or delete the record.

Microsoft Azure

In Azure, create the resource with this exact name again (app, cloud service, storage account, Traffic Manager profile…). Or delete the record.

Readme.io

In ReadMe, set this host as the project's custom domain again. Or delete the record.

Surge.sh

Publish a Surge project to this host again (surge --domain <host>). Or delete the record.

UptimeRobot

In UptimeRobot, add this host as the status page's custom domain again. Or delete the record.

WordPress.com

In WordPress.com, add this host as the site's domain again. Or delete the record.

Delete DNS records before the things they point at, and keep a list of what each subdomain is for.

Delete the DNS record before the resource

When you shut down an app, bucket or site, remove the CNAME or A record first, then delete the resource. The other way round leaves a gap anyone can step into.

Keep an inventory

Know which subdomains exist and what each one points at. Connecting your DNS host to nmspc keeps the list for you, with every change.

Turn on two-factor sign-in at the registrar and DNS host

Whoever gets into those accounts can change every record. A passkey or an authenticator app stops a stolen password from being enough.

Keep the transfer lock on

clientTransferProhibited stops the domain being moved to another registrar without you unlocking it first.

Watch the domains your nameservers and mail live on

If ns1.youragency.net serves your zone, youragency.net expiring takes your domain with it. The same goes for a mail host on a domain you no longer renew.

Every day, for every domain you own, free. nmspc checks the nameservers, mail servers, the bare domain and www, and every record it reads from a connected DNS host (Cloudflare, Loopia, Porkbun, Spaceship, GoDaddy, Vercel). A new problem sends you a notification once, and it clears by itself when the record is fixed. Watched subdomains are checked too on Pro.

Start free and the check runs with the next daily DNS check.

The ones the community list can-i-take-over-xyz marks as open to takeover, 24 today, checked on 2026-10-25. Services the list calls edge cases, because the provider blocks takeovers in most setups, are shown as worth knowing with the reason, never as something to fix. Services the list calls safe, such as Fastly and Zendesk, are left out.

AWS Elastic Beanstalk, AWS S3, Agile CRM, Airee.ru, Anima, Bitbucket, Discourse, Gemfury, Ghost, HatenaBlog, Help Juice, Help Scout, JetBrains YouTrack, Microsoft Azure, Ngrok, Readme.io, SmartJobBoard, Strikingly, Surge.sh, SurveySparrow, Uberflip, UptimeRobot, WordPress.com, Worksites. Source: can-i-take-over-xyz.

GitHub Pages

GitHub blocks others from claiming it only if you verified the domain in GitHub's settings; otherwise someone could.

Heroku

Since 2023 Heroku gives each new custom domain its own random DNS target that nobody else can reuse, but a record pointing at an old app-name address (herokuapp.com) may still be claimable.

Netlify

Netlify now asks for a TXT record proving you own the domain before someone else can add it, so a takeover is unlikely, but the record leads nowhere.

Tumblr

Since June 2023 Tumblr only connects new domains bought through Tumblr itself, so others are unlikely to claim it, but the record leads nowhere.

Webflow

Webflow needs a paid site plan and, by recent reports, a TXT record to connect a domain, so a takeover is unlikely, but the record leads nowhere.

Vercel

Vercel asks anyone adding a domain that's in use by another account to prove they own it, so a takeover is unlikely, but the record leads nowhere.

No. It only reads DNS and asks your own subdomain for its home page, the way a browser would. It never creates anything at a service and never calls a provider's API.