The subdomain still pointing at a service you cancelled

The invoice was the last you heard of it. A service you’d stood up on a subdomain — a status page, a help-desk widget, a landing page on a website builder — stopped being useful, so someone sensibly cancelled the subscription to stop the monthly charge. Job done. The account closed, the bill stopped, and everyone moved on. What nobody did, because it looked like tidying up a loose end that no longer mattered, was go into your DNS and remove the record that still points that subdomain at the service you just cancelled.

That leftover record isn’t harmless. It still tells the world that help.yourdomain.com lives on a particular cloud provider — but the thing that used to answer there is gone, and the name it used has gone back into that provider’s pool for the next customer. If a stranger registers that now-free name, your still-live record hands them your subdomain. They can serve whatever they like from help.yourdomain.com — a fake login, a phishing form, malware — and to a visitor, and often to the browser’s padlock, it is genuinely your domain, carrying your name and your reputation. This is a subdomain takeover, and cancelling a service without clearing its DNS is the most common way to set one up.

That’s the quiet failure: not a break-in, but the order you did two simple things in — you closed the account, then didn’t remove the sign that still points at where it used to be.

Why it stays invisible

A record pointing at a cancelled service breaks nothing you’d ever notice. It’s a subdomain you’ve stopped using, so no colleague hits an error, no customer complains, nothing bounces. Your main site is unaffected. The record simply sits in your DNS, quietly advertising an address that’s now up for grabs.

The danger comes from a mismatch in how the two halves get retired. Cancelling the service is a billing action — it happens in an account somewhere, often done by whoever owns the budget. Removing the DNS record is a technical action in a completely different place, often owned by someone else entirely, or by no one in particular. So the natural sequence is exactly the dangerous one: the subscription ends first, freeing the name on the provider, while the record that points at it lingers for weeks, months or years. A June 2026 piece on dangling CNAMEs published on the Cloud Security Alliance’s blog makes the same point — the gap between decommissioning a resource and cleaning up its DNS is where these takeovers live.

And they accumulate the way forgotten things always do. Every trial you didn’t renew, every supplier you moved away from, every retired campaign can leave a pointer behind. Nobody keeps the list, because the services it points at are long gone from everyone’s mind — which is precisely why the record outlives the thing it named.

Find it yourself

You can audit your own DNS in about ten minutes. The hard part is just getting the whole list in front of you.

1. Export every DNS record. Log in to wherever your DNS lives — your registrar, or a provider such as Cloudflare or Route 53 — and open or export the full zone. You want every CNAME record, plus any A record pointing at a cloud service rather than at your own server.
2. For each one, ask: does this still point at something we own and pay for? Go down the list. For every subdomain, either open it in a browser or, if you’re comfortable at a command line, run dig +short CNAME help.yourdomain.com to see its target and curl -sI https://help.yourdomain.com to see what answers. The tell-tale of danger is the provider’s own error: “no such bucket,” “there isn’t a site here yet,” “no app configured.” That means your name points at a vacancy anyone can fill.
3. Cross-check against what you’ve cancelled. This is the specific tell for this failure. Think back over the last couple of years of services you stopped paying for — the status page, the form builder, the old support tool. For each, check whether its subdomain is still in your DNS. A cancelled service with a live record is the exact set-up an attacker wants.
4. No command line? Just visit them. Type each subdomain into a browser. A page that clearly isn’t yours, or a hosting provider’s “resource doesn’t exist” error, is your answer. Slower than a script, but it needs nothing installed.

The usual result is finding two or three names still pointing hopefully at services the business stopped paying for long ago.

The fix

Closing this is mostly deletion, which is satisfyingly simple.

Remove the record for anything you’ve cancelled. If a subdomain points at a service you no longer pay for, delete the DNS record. That single deletion removes the sign, and with it the takeover — there’s nothing left for anyone to claim.

Fix the order, permanently. These appear because the service is cancelled while the DNS is left behind. Flip the sequence: whenever you retire something hosted, remove or repoint its DNS record first, and only then close the account or release the resource — so there’s never a live pointer aimed at a vacancy.

Reclaim anything you actually still want. If a dangling subdomain is one worth keeping, don’t just leave it exposed — re-create the resource on the provider so you hold the name again, then decide deliberately whether to keep or retire it.

Give the list an owner, and look twice a year. The root cause is that nobody owns the DNS zone. A simple record of what each subdomain is for, revisited a couple of times a year and updated whenever a service is cancelled, turns “the record everyone forgot” into “the record we check.”

None of this needs a security team. It needs someone to open the DNS zone once, put it next to the list of things you’ve stopped paying for, and make sure the two agree.