HIGH SEVERITYDNSCVSS 8.6Requires Account VerificationID: fastly-cdn
Fastly CDN Dangling DNS & Takeover Fingerprint
The CNAME points to Fastly edge routers, but no Fastly service is currently configured to handle requests for this host. Anyone with a Fastly account can claim the domain on their service.
DNS CNAME Delegation Rules
*.fastly.net
CNAME points to *.fastly.net. Edge server responds with Fastly error: unknown domain.
404 / 500
Authoritative Response Token
“Fastly error: unknown domain”
curl -sI http://subdomain.example.com | grep 'Fastly error: unknown domain'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Delete the Fastly CNAME record from DNS or add the domain to your authorized Fastly service.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.fastly.net. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Delete stale Fastly CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Fastly CDN Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Fastly CDN Takeover FAQs
Fastly allows account holders to add domains to services. If a custom domain CNAME already points to Fastly edge IPs without an active service binding, attackers can claim the domain.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Fastly CDN Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.