# Do your subdomains depend on a domain that is about to lapse?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This check flags subdomains pointing to a domain that looks unregistered, is being deleted or expires soon, so a new owner never inherits your traffic.

This check flags an address on your domain that points to another domain which looks unregistered, is being deleted or expires soon. If someone else later registers that domain, they could steer your address.

## What does this check look at?

It looks at whether a domain one of your addresses points to looks unregistered, is being deleted or expires soon. It reads public registration records for the domain your address points to. Reading DNS records, certificate logs and domain registration never touches your site.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site. It applies only when public certificate history for the domain could be read.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Finding | The target domain has a registration warning sign. | Confirm renewal with its owner, or remove the record if you no longer need it. |

Registry data does not show the domain can be bought or that someone else controls it. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Fix this soon. A finding of this kind needs a victim or a second step before it causes harm, so it ranks below anything someone could use directly. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Someone who later acquires the domain your address depends on |
| The protection that should stop it | That domain's registry record needs review |
| What is reached | DNS for your subdomain |
| What follows | Influence over where your address sends visitors |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

Start with the owner of the other domain, often a vendor. Change DNS only if the dependency is gone or cannot be secured.

:::fix-prompt any
One of my subdomains points to a domain with a registration warning: [paste the address and target domain from the report]. Tell me which service or vendor that domain belongs to and whether I still depend on it. Draft a short message I can send the owner asking them to confirm renewal. If I no longer need it, give me the exact DNS record to remove.
:::

## How to check

Say Atlas, our example app at `atlas.example`, points a links address at a small vendor whose domain expires next month. The check flags it so the team can ask before it lapses.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Does this mean someone else owns the domain now?

No. Registry data only shows a warning sign. It does not show the domain can be bought or that control has changed.

### Should I delete the record straight away?

Only if you no longer use the service. Otherwise ask the owner about renewal first, so you do not break something that works.

## Sources

- [How we check](https://www.lockpick.app/docs/security/how-we-check), Lockpick docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07