Description

Ensure every CNAME record in the zone points to a hostname that still exists and is controlled by your organization, such as an active cloud service, CDN, or SaaS endpoint. Records that point to deleted or unclaimed resources, known as dangling records, should be removed or updated.

Rationale

When a cloud resource or SaaS account is deleted but its CNAME record is left in DNS, an attacker can often claim the same resource name and take over your subdomain. They can then host phishing pages, steal cookies, or damage your brand under your own domain. Removing dangling records closes this subdomain takeover risk.

Impact

  • Prevents attackers from taking over your subdomains

  • Removes records that point to services no longer in use

  • Subdomains that relied on removed records will stop resolving

Default Value

Cloudflare does not check whether CNAME targets are still valid. Records remain in the zone until they are edited or deleted.

Pre-Requisites

  • Cloudflare account with Administrator or DNS permissions for the zone

  • An inventory of the services each subdomain should point to

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Filter the list by Type CNAME.

  5. For each record, check that the target hostname resolves (for example, run dig <target> or nslookup <target>) and belongs to an active service you control.

  6. If any record points to a hostname that does not resolve, or to a deleted or unclaimed resource, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Find the dangling CNAME record.

  5. If the subdomain is no longer needed, select Edit and then Delete, and confirm.

  6. If it is still needed, select Edit, change the Target to the correct active hostname, and select Save.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to DNS > Records.

  4. Select Add record and re-create the CNAME record with its previous name and target.

Reference