Could someone take over a forgotten subdomain of yours?

The subdomain takeover check flags an address on your domain that points at a service where the account behind it looks missing. Anyone who creates that account could publish pages on your real address.

What does this check look at?

It looks at whether an address on your domain points to a service where anyone could create the missing account behind it. It matches the service against a public list of services known to allow takeovers, using DNS and certificate logs only.

If someone else can then claim that spot on the service, they control a real address on your domain. That's called a subdomain takeover, and it is convincing because the address really is yours.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site. It applies only when public certificate history for the domain could be read.

What does a result mean?

Claiming is never tried, so it does not prove the address can be taken over today. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Fix this first when it is confirmed. Anyone could use a finding of this kind on their own, with no victim and no second step. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label. Whoever claims it serves pages on your real domain and receives cookies set for all of it.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

Deleting the dangling record is the fastest safe fix. Recreate the service only if you still need it.

This subdomain of mine points at a service that looks unclaimed: [paste the address and target from the report]. Check my DNS records for it and tell me which service it points to. If I no longer use that service, give me the exact record to delete now. If I still need it, tell me how to recreate or reclaim the resource at that provider so the address is mine again.

How to check

Say Atlas, our example app at atlas.example, once ran a docs site on a hosting service and closed that project last year. The DNS record still points there, and the check flags it as claimable.

Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.