# Ensure DNS records pointing to hostnames have valid targets without takeover risk

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787214478343-ensure-dns-records-pointing-to-hostnames-have-valid-targets-without-takeover-risk
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every CNAME record in the zone points to a hostname that still exists and is controlled by your organization, such as an active cloud service, CDN, or SaaS endpoint. Records that point to deleted or unclaimed resources, known as dangling records, should be removed or updated.

**Rationale**

When a cloud resource or SaaS account is deleted but its CNAME record is left in DNS, an attacker can often claim the same resource name and take over your subdomain. They can then host phishing pages, steal cookies, or damage your brand under your own domain. Removing dangling records closes this subdomain takeover risk.

**Impact**

-   Prevents attackers from taking over your subdomains
    
-   Removes records that point to services no longer in use
    
-   Subdomains that relied on removed records will stop resolving
    

**Default Value**

Cloudflare does not check whether CNAME targets are still valid. Records remain in the zone until they are edited or deleted.

**Pre-Requisites**

-   Cloudflare account with Administrator or DNS permissions for the zone
    
-   An inventory of the services each subdomain should point to
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Filter the list by Type CNAME.
    
5.  For each record, check that the target hostname resolves (for example, run dig <target> or nslookup <target>) and belongs to an active service you control.
    
6.  If any record points to a hostname that does not resolve, or to a deleted or unclaimed resource, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Find the dangling CNAME record.
    
5.  If the subdomain is no longer needed, select Edit and then Delete, and confirm.
    
6.  If it is still needed, select Edit, change the Target to the correct active hostname, and select Save.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to DNS > Records.
    
4.  Select Add record and re-create the CNAME record with its previous name and target.
    

**Reference**

-   [https://developers.cloudflare.com/dns/manage-dns-records/](https://developers.cloudflare.com/dns/manage-dns-records/)
    
-   [https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.