# Which addresses on your domain are controlled by other companies?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This check lists subdomains that point to services run by other companies, so each one has a known owner. Pointing elsewhere is normal; forgetting is the risk.

This check lists addresses on your domain that point to a service run by another company, such as a help desk, status page or shop. Whoever manages that service decides what appears at your address.

## What does this check look at?

It looks at whether an address on your domain points to a service run by another company. Addresses come from public certificate logs and DNS, and nothing is contacted. Reading DNS records, certificate logs and domain registration never touches your site.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site. It applies only when public certificate history for the domain could be read.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | An address points to another company. | Confirm you still use that service and know who manages it. |

Pointing elsewhere is normal for many services, so it does not show anything is wrong, only who controls that address. When you stop using the service but leave the pointer, the address still points there. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Fix this soon. A finding of this kind needs a victim or a second step before it causes harm, so it ranks below anything someone could use directly. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Whoever controls the third-party domain the address points to |
| The protection that should stop it | The CNAME leaves your registrable domain |
| What is reached | What your subdomain serves |
| What follows | They decide what appears at your address |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

This is a short review, and an AI with read access to your DNS can draft it.

:::fix-prompt any
Here are subdomains of my domain that point to other companies: [paste the list from the report]. For each one, tell me which service it points to, whether I still use it, and who on my team manages it. For any I no longer use, give me the exact DNS record to delete. Do not delete anything yourself.
:::

## How to check

Say Atlas, our example app at `atlas.example`, points its help address at a support desk provider. The check lists it so the team can confirm the account is still theirs.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Is pointing a subdomain at another company a problem?

No. It is how most hosted tools work. It becomes a problem when the account behind it is closed and someone else can claim it.

### How is this different from the takeover check?

This one lists every address that points elsewhere. The takeover check flags the ones whose service looks unclaimed.

## Sources

- [How we check](https://www.lockpick.app/docs/security/how-we-check), Lockpick docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [Lookalike domains](https://www.lockpick.app/docs/learn/lookalike-domains), Lockpick docs, read on 2026-10-07