Why does Elastic Beanstalk return NXDOMAIN instead of an HTTP error?

Q: Why does Elastic Beanstalk return NXDOMAIN instead of an HTTP error?

When an Elastic Beanstalk environment is terminated, AWS deprovisions the load balancer and deletes the DNS A record in the elasticbeanstalk.com zone. The CNAME still points to it, resulting in NXDOMAIN.

CRITICAL SEVERITYCLOUDCVSS 9.1Immediate (<90s)ID: aws-elastic-beanstalk

AWS Elastic Beanstalk Dangling DNS & Takeover Fingerprint

An Elastic Beanstalk environment was terminated, releasing the regional subdomain prefix back to the public pool. Attackers can provision a new Beanstalk app with the identical environment name.

DNS CNAME Delegation Rules

Target CNAME Delegation

*.elasticbeanstalk.com

DNS Resolution Indicator

NXDOMAIN (Authoritative server reports no host mapping)

Expected HTTP Status Code

NXDOMAIN

Authoritative Response Token

Vulnerable Body Indicator String

“NXDOMAIN DNS Error”

CLI Verification Command

dig +short CNAME subdomain.example.com && dig +short $(dig +short CNAME subdomain.example.com)

When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.

Remediation Guide & Defensive Action Plan

Immediate Action Required: Delete the CNAME record or recreate the Elastic Beanstalk environment in the same AWS region.

Defensive Verification Checklist:

Audit authoritative DNS zone records for any CNAME pointing to *.elasticbeanstalk.com.
Verify whether the target resource or bucket still exists under your organization's cloud tenant.
If decommissioned, delete the DNS record immediately to close the public exposure window.
Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.

Terraform Remediation Example

# Delete dangling Elastic Beanstalk CNAME

Open Dedicated AWS Elastic Beanstalk Terraform Solution Guide →

ATTACK SURFACE DETECTION COMPARISON

Why Static DNS Scanners Miss AWS Elastic Beanstalk Takeovers

Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.

SubdomainWatch vs SecurityTrails →SubdomainWatch vs Detectify →All 5 Competitor Benchmarks →

AWS Elastic Beanstalk Takeover FAQs