Dangling NS
A zone delegated to a nameserver that no longer answers. Rare, but whoever controls that server controls every record in the zone.
[ ABOUT THE PROJECT ]
The records you
forgot remember you.
Danglegeddon is a free, read-only scanner that finds DNS records pointing at infrastructure that no longer exists — before someone else claims it and starts serving content under your name.
What is dangling DNS?
Teams spin up a cloud app, a storage bucket or a SaaS page, point a subdomain at it, and later shut the service down. The DNS record stays behind. It still says “this name lives over there” — but nothing is there anymore.
If the destination can be re-registered, whoever claims it inherits your hostname: your brand, your trusted domain, often a valid TLS certificate. That is a subdomain takeover.
Dangling MX
Mail routed to a host that is gone. A claimant could receive your mail — including password resets and verification codes.
Dangling CNAME
The most common case. The hostname still resolves to a provider, but the resource behind it was deprovisioned and can be claimed.
THE RESEARCH BEHIND THE NAME
Silent Push: “Welcome to Danglegeddon”
In mid-2026, the Silent Push research team ran a large-scale, simulated subdomain-takeover exercise they named Danglegeddon. They examined organizations in four sectors — government, banking, automotive manufacturing and pharmaceuticals — focusing first on records pointing at Microsoft Azure services such as Blob Storage, virtual machines and web apps. Takeovers were simulated, redirected to researcher-controlled content and reported through vulnerability disclosure and bug bounty programs.
~12,500apex domains in the initial sample
~16,000dangling subdomains isolated
~4,000takeovers automated in simulation
1,437dangling CNAMEs on one automaker’s apex
Figures as reported by Silent Push; see the full report for methodology and context.
Key takeaways
- CNAMEs dominate. Across all four sectors, dangling CNAME records far outnumbered MX and NS findings.
- NS is the worst case. Silent Push calls dangling NS delegations “the worst of the three and the least common.”
- A takeover is a foothold, not the end. The real damage comes from what trusts the hostname: phishing on a legitimate domain, OAuth redirects, parent-domain cookies, script includes, allowlists and certificate issuance.
- Provider safeguards matter. Thousands of candidates were judged safe because the provider requires domain-ownership verification before a custom hostname works.
From their recommendations to this scanner
| Silent Push recommends | How Danglegeddon helps |
|---|---|
| Fix by blast radius: NS first, then MX, then external CNAMEs | Authoritative delegation checks flag lame or unresolvable nameservers; every finding carries record-specific remediation. |
| Know every record you publish | Zone file import checks the whole inventory, not just names you remember. |
| Remove the DNS record before deprovisioning the resource | Remediation text for each record type, and a shareable report to hand to the record’s owner. |
| Prefer providers that verify domain ownership | Provider fingerprints name the platform behind each target and what to verify in that account. |
| Monitor certificate transparency logs | Automatic subdomain discovery from CT logs is in progress. |
| Monitor continuously | Scheduled re-scans are on the roadmap. |
How Danglegeddon works
The scanner asks two independent public resolvers — Cloudflare and Google — about your records, then checks whether each CNAME, MX, NS and SRV target still exists. Optionally, it asks your registry and each nameserver directly whether they really serve your zone.
Read-only, always
No resources are claimed, no takeovers attempted, no HTTP requests sent to your targets. It reports indicators; it never proves exploitability.
Nothing stored
Scans run in memory. Shared reports live entirely in their link. Names you scan are, however, sent to public DNS resolvers.
Your domains only
Scan infrastructure you own or are authorized to assess. Findings are not permission to claim anyone else’s resources.
Credits & further reading
- Welcome to Danglegeddon — Silent Push research team, July 2026. The study this project’s name and focus come from.
- can-i-take-over-xyz — community list of which services are vulnerable to subdomain takeover.
Danglegeddon is an independent project. It is not affiliated with, endorsed by or operated by Silent Push. All research findings quoted here belong to their authors.