Technical guide
How to find forgotten subdomains
Discovery reconciles external signals with internal ownership. A longer list is not useful until someone validates which assets remain in service.
The problem
Experiments, migrations, and vendors leave DNS names behind after teams change. Those services may run old software, use expired certificates, or point to claimable third-party resources.
Risks and assumptions
Abandoned internet-facing services.
Subdomain takeover through stale external references.
Assets outside patching, logging, and ownership processes.
Procedure
Start from authorized domains
Define roots and scope instead of enumerating arbitrary third parties.
Combine sources
Use DNS, authorized logs, Certificate Transparency, and cloud inventory.
Normalize and deduplicate
Handle IDNs, wildcards, historical names, and currently resolving names separately.
Validate safely
Check resolution, TLS, and minimal service metadata without exploitation.
Assign ownership
Classify active, retired, approved third party, or unknown and open a concrete action.
Limits of a manual approach
CT only shows names included in public certificates.
Passive DNS and search sources have uneven coverage and delay.
Wildcard DNS may answer for names that were never provisioned.
Example
`staging.example.com` appears in CT and points to a deleted cloud service. Before declaring takeover, verify the dangling reference, account ownership, and provider behavior.
Common mistakes
Treating every CT name as currently active.
Ignoring wildcard DNS or shared CDNs.
Discovering assets without assigning ownership and review dates.
Recommendations
Repeat discovery to observe additions and removals.
Connect findings to inventory and project offboarding.
Retire DNS, certificates, and cloud resources in a coordinated sequence.
Frequently asked questions
Does CT reveal every subdomain?
No. It covers names in logged public certificates, not all subdomains.
Does resolution prove a service is active?
No. It may be a wildcard, placeholder, or abandoned target.
What is subdomain takeover?
It is the ability to claim an external resource still referenced by DNS and must be checked carefully and with authorization.
Keep inventory current
Repeat discovery and connect external assets to prioritized findings.
Explore the moduleRelated content
External discovery
External attack surface management (EASM)
Discover subdomains and internet-exposed assets related to authorized domains, prioritize findings, and monitor external attack-surface changes.
Technical guide
What is external attack surface management?
Learn how EASM discovers, validates, and monitors internet-exposed assets and how it differs from a point-in-time scan.