# Ensure DNS records do not point to removed Render custom domains

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876671459478-ensure-dns-records-do-not-point-to-removed-render-custom-domains
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that no DNS record, such as a CNAME pointing to an onrender.com hostname or an A record pointing to Render's IP address, still exists for a domain that is no longer attached to a Render service. These dangling records should be removed when a custom domain or service is deleted.

**Rationale**

If a DNS record still points to Render after the domain is removed from your service, an attacker may be able to add that domain to their own Render service and take over the subdomain. They could then host phishing pages or steal cookies under your domain.

**Impact**

-   Prevents subdomain takeover
    
-   Keeps DNS records accurate
    
-   Removed subdomains stop resolving
    

**Default Value**

Render does not delete DNS records at your DNS provider when a custom domain is removed.

**Pre-Requisites**

-   Access to your DNS provider
    
-   Admin or Developer role in Render
    

**Remediation**

**Test Plan**

1.  In your DNS provider, list all records that point to Render (CNAME targets ending in onrender.com, or A records pointing to Render).
    
2.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
3.  For each record, check that the domain is listed under Custom Domains on the Settings page of an active web service or static site, or use the Render API's List custom domains endpoint for each service.
    
4.  If a record points to Render for a domain that is not attached to any service, follow the implementation steps.
    

**Implementation Steps**

1.  In your DNS provider, delete the dangling CNAME or A record.
    
2.  Make removing DNS records part of the process whenever a custom domain or service is deleted in Render.
    

**Backout Plan**

1.  Re-create the DNS record and add the domain back under Custom Domains in the service's Settings if it is still needed.
    

**Reference**

-   [https://render.com/docs/custom-domains](https://render.com/docs/custom-domains)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.