A DNS alias that points at nothing

When you delete a site at a hosting provider but leave its DNS record in place, your subdomain still points at the provider. If someone else can claim that name there, they can serve their own content on your subdomain.

Here's a canonical name (CNAME) record that sends blog.example.com to a host, and what the host's name answered before and after you deleted the blog:

blog.example.com.  CNAME  blog-4821.hosting.example.

Before:  blog-4821.hosting.example.  A  192.0.2.10
After:   blog-4821.hosting.example.  status: NXDOMAIN

NXDOMAIN is the DNS answer for a name that doesn't exist. The alias now points at nothing.

How we watch the alias

We check for this change because a deleted host can leave your subdomain open to someone else's content.

Add a DNS monitor for blog.example.com with the record type A, AAAA or CNAME. With A or AAAA, when the name's CNAME points outside your own DNS zone, we watch that alias in place of the addresses behind it. With CNAME, we watch the record itself and check that its target still exists.

A new monitor ticks No dangling alias. This assertion holds when there's no alias or the alias resolves. We record the change above as "Alias stopped resolving". We alert only on assertions you've ticked.

What the check misses

We count an alias as dangling only when the target name doesn't exist. If the provider's DNS still answers after you delete the site, the check passes, though the name may still be open to takeover. If the target disappears and someone claims it between two scans, no scan sees it dangle.

If someone claims the target and it resolves again, you get Fixed: No dangling alias. If you didn't make the fix, check who controls the target now.

When you retire a host, remove its DNS record first, as MDN's page on subdomain takeover advises.