takeover.risk Reviewed July 2026

Quick fix

Disable or remove the affected DNS record as the fastest containment action.

What this finding means

This finding is emitted only when a dangling relationship also matches bounded provider-specific evidence. It indicates material takeover risk, but ownership should still be verified directly in the provider control plane before remediation is closed.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact A claimable third-party target can let an attacker publish content, obtain trust, and abuse cookies or links under your domain.

Step-by-step fix

Where to make the change

  • The authoritative DNS provider and, for DNSSEC delegation, the domain registrar.
  • The cloud, CDN, SaaS, or hosting tenant referenced by the affected DNS record.

Remediation procedure

  1. Disable or remove the affected DNS record as the fastest containment action.
  2. Claim the resource in the authorized tenant if the hostname must remain active.
  3. Invalidate cached content, credentials, webhooks, OAuth redirects, and certificates associated with the hostname.
  4. Search for additional records pointing to the same retired provider resource.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Trace authoritative DNS
dig +trace example.com

Inspect common records
dig +short A example.com
dig +short AAAA example.com
dig +short CNAME host.example.com

Verify the fix

  1. Confirm the DNS record no longer references an unclaimed target.
  2. Verify the hostname serves only the intended controlled application.
  3. Check certificate transparency for unexpected certificates.
  4. Repeat the external scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Attempting to prove takeover by claiming a production resource without authorization.
  • Fixing only the visible hostname while aliases remain.
  • Ignoring wildcard DNS records.

Authoritative references