Description

Ensure that no DNS record, such as a CNAME pointing to an onrender.com hostname or an A record pointing to Render's IP address, still exists for a domain that is no longer attached to a Render service. These dangling records should be removed when a custom domain or service is deleted.

Rationale

If a DNS record still points to Render after the domain is removed from your service, an attacker may be able to add that domain to their own Render service and take over the subdomain. They could then host phishing pages or steal cookies under your domain.

Impact

  • Prevents subdomain takeover

  • Keeps DNS records accurate

  • Removed subdomains stop resolving

Default Value

Render does not delete DNS records at your DNS provider when a custom domain is removed.

Pre-Requisites

  • Access to your DNS provider

  • Admin or Developer role in Render

Remediation

Test Plan

  1. In your DNS provider, list all records that point to Render (CNAME targets ending in onrender.com, or A records pointing to Render).

  2. Sign in to the Render Dashboard at https://dashboard.render.com.

  3. For each record, check that the domain is listed under Custom Domains on the Settings page of an active web service or static site, or use the Render API's List custom domains endpoint for each service.

  4. If a record points to Render for a domain that is not attached to any service, follow the implementation steps.

Implementation Steps

  1. In your DNS provider, delete the dangling CNAME or A record.

  2. Make removing DNS records part of the process whenever a custom domain or service is deleted in Render.

Backout Plan

  1. Re-create the DNS record and add the domain back under Custom Domains in the service's Settings if it is still needed.

Reference