Subdomain Security: Common Threats and How to Protect Your Infrastructure

Subdomains that are poorly managed represent a significant attack surface. Subdomain takeover — one of the most common and damaging subdomain-related vulnerabilities — affects major organizations regularly. Securing your subdomain infrastructure requires both technical controls and organizational processes.

Subdomain Takeover Attacks

A subdomain takeover occurs when a subdomain's DNS record points to a service or resource that is no longer active, and an attacker claims that resource. For example: a developer creates staging.example.com pointing to a Heroku app, then deletes the Heroku app without removing the DNS record. The DNS record still points to the now-deleted Heroku deployment. An attacker creates a new Heroku app at the same address and can now serve content from staging.example.com — under your domain, with your SSL certificate trust. This can be used for phishing, credential harvesting, or malware distribution.

The fix is simple: when decommissioning any service that has a subdomain pointing to it, delete the DNS record before or at the same time as the service. The record should never outlive the resource it points to.

Dangling DNS Records

Dangling DNS records are any DNS entries pointing to infrastructure that no longer exists or is not actively managed. These are the root cause of subdomain takeover. Maintaining an accurate inventory of all subdomains and their corresponding services — in a spreadsheet, CMDB, or infrastructure-as-code system — is the organizational control that prevents dangling records from accumulating.

Cross-Origin and Cookie Security

Subdomains can inadvertently share cookies with sibling subdomains or the parent domain depending on cookie domain configuration. If a cookie is set with Domain=example.com, it is sent to all subdomains of example.com. A compromised or attacker-controlled subdomain could then access session cookies intended for the main application. Use the most specific cookie domain possible, and consider the SameSite and Secure attributes on all authentication cookies.

The document.domain property in JavaScript also interacts with subdomain isolation — setting it to the parent domain allows cross-subdomain DOM access, which is dangerous. Modern Content Security Policies and proper iframe sandbox configuration help prevent unintended cross-origin interactions.

HSTS and Subdomains

HTTP Strict Transport Security (HSTS) with the includeSubDomains directive forces HTTPS on all subdomains. This prevents protocol downgrade attacks. However, enabling includeSubDomains means all subdomains must serve valid HTTPS — any subdomain without a valid certificate becomes inaccessible over HTTP. Audit all subdomains for valid SSL coverage before enabling includeSubDomains.

Use our subdomain enumeration tools to audit your infrastructure, or read about using subdomains for microservices architecture patterns.