SubdomainWatch is an autonomous Attack Surface Management (CASM) platform and Shift-Left sentinel. We eliminate dangling DNS takeovers, RFC 7208 SPF lookup exhaustion, and SSL/TLS expiration blackouts through continuous verification and pre-merge Terraform gates.
Modern cloud velocity creates two structural perimeter failures that traditional port scanners miss:
When S3 buckets, Heroku dynos, or CDN origins are deleted, active CNAME records frequently linger in DNS. Attackers register the abandoned target namespace to claim your subdomain—bypassing CORS, hijacking session cookies, and hosting weaponized phishing.
Every added SaaS integration (SendGrid, Zendesk, Salesforce) adds an SPF include:. Exceeding 10 DNS queries triggers a hard PermError, causing Google and Microsoft mail servers to silently route customer correspondence to spam.
Quarterly vulnerability assessments miss DNS state because it is ephemeral. A Terraform PR merged at 9:00 AM can create an exploitable dangling CNAME in 90 seconds; a SaaS include update can breach the 10-lookup ceiling overnight without any repository commit. Security requires continuous surveillance paired with pre-merge IaC gates.
Every finding is verified against live public DNS infrastructure with deterministic protocol proofs:
Recursive DNS resolution & HTTP token verification for orphaned AWS S3, Heroku, Azure, and CDN assets.
Recursive SPF include counter enforcing the ≤10 lookup limit to prevent silent PermError delivery drops.
Automated 30d, 14d, and 7d milestone escalation before failed ACME renewals trigger user-facing outages.
16-prefix scanner evaluating HTTP basic auth barriers, leaked stack traces, and missing noindex tags.
Strict RFC 1918/IMDS egress filtering with an atomic 2-clean-scan window to eliminate flapping alert fatigue.
Fixing a compromised subdomain post-incident is costly. SubdomainWatch includes Takeover Guard, an open-source Go security binary and GitHub Action that analyzes Terraform plans directly in pull requests.
name: Takeover Guard Gate
on: [pull_request]
jobs:
guard:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- uses: subdomainwatch/takeover-guard@v2
with:
plan_file: 'tfplan.json'
fail_on_severity: 'CRITICAL'
sarif_file: 'subdomainwatch-guard.sarif'
Engineered from the belief that external security monitoring should be deterministic, transparent, and non-invasive. We reject probabilistic heuristics in favor of protocol-level proofs and reproducible evidence.
DNS telemetry queried by SubdomainWatch is never resold or retained longer than necessary for differential scan analysis. We operate with strict data minimization principles and cryptographic auditability.
Our cloud takeover signatures database and Takeover Guard CI/CD analyzer are publicly maintained on GitHub, allowing the wider cybersecurity ecosystem to audit, contribute, and benefit from collaborative threat intelligence.
Navigate our complete directory of free diagnostic security tools, cloud provider takeover signatures, infrastructure solutions, and protocol implementation guides.
Free standalone browser tools for instant, deterministic DNS and infrastructure security analysis.
Recursive CNAME resolution and 42 cloud provider orphan token verification.
Recursive include evaluation preventing silent email PermError delivery drops.
X.509 chain inspection with automated 30d, 14d, and 7d incident escalation.
Anti-spoofing policy analysis and Google/Yahoo bulk-sender alignment checks.
16-prefix reconnaissance, auth barrier validation, and robots.txt leak audits.
SMTP downgrade defense, TLS-RPT evaluation, and strict transport posture.
Cryptographic DS, DNSKEY, and RRSIG validity verification from root anchors.
Centralized hub with all 7 free security utilities and API probe entrypoints.
Authoritative fingerprint database for detecting abandoned cloud infrastructure and dangling DNS pointers.
Searchable catalog of verified HTTP response tokens and canonical CNAME patterns.
Detection tokens and verification criteria for unclaimed NoSuchBucket S3 targets.
Orphaned CNAME patterns pointing to unconfigured GitHub Pages repositories.
Identification tokens for deleted Heroku dynos retaining active DNS records.
Unclaimed Traffic Manager, App Service, and Azure CDN orphan detection.
Orphaned CloudFront aliases vulnerable to cross-tenant distribution claims.
Unclaimed Fastly service endpoints with active canonical DNS pointers.
Verification of deactivated Shopify storefronts retaining live brand DNS records.
Practical playbooks, Terraform remediation recipes, and architectural blueprints for closing DNS vulnerabilities.
Comprehensive catalog of provider-specific remediation guides and CVSS scoring.
Interactive visual walk-through of DNS orphan cleanup and automated verifications.
Live demonstration of multi-domain posture scoring, radar HUD, and telemetry.
Real-time attack surface management, subdomain rosters, and tenant alert controls.
Deep-dive technical documentation on internet protocol specifications and email deliverability hardening.
Step-by-step SPF, DKIM, and DMARC alignment recipes for 20+ email service providers.
Configuration manuals for Cloudflare, Route53, Google Cloud DNS, and Namecheap.
Architectural techniques for flattening SPF records and eliminating 10-lookup exhaustion.
Migrating safely from p=none to p=reject with automated RUA report aggregation.
Open specifications, cryptographic proofs, zero-retention policies, and transparent operating rules.
Complete 3-tier engine architecture, PostgreSQL outbox, and scanning engine specs.
Guidelines and safe harbor commitments for security researchers reporting vulnerabilities.
Formal declaration of our non-retention stance on queried DNS records and telemetry.
Tenant usage agreements, scan rate limits, and SLA commitments.
Fixed monthly tiers with unlimited seats and zero per-scan surcharges.
SubdomainWatch builds directly upon published standards governed by the Internet Engineering Task Force (IETF) and OASIS Open. We link to authoritative specifications for full verification.
Sender Policy Framework (SPF) for Authorizing Use of Domains in Email (10-DNS-Lookup Limit)
Domain-based Message Authentication, Reporting, and Conformance (DMARC) Protocol
SMTP Mail Transfer Agent Strict Transport Security (MTA-STS) Specification
Protocol Modifications for the DNS Security Extensions (DNSSEC Cryptographic Chain)
Static Analysis Results Interchange Format for GitHub Security Tab Integration
Core security engine, Takeover Guard GitHub Action, and public threat signatures
Execute an immediate, non-invasive scan across our 42 cloud takeover signatures, RFC 7208 SPF lookup limits, and TLS certificate chains. Or install our open-source GitHub Action to guard Terraform pull requests automatically.
Returns immediate JSON telemetry: root DNS delegation, CNAME chain status, SPF recursive depth, DMARC alignment, and X.509 validity dates.