Can anyone claim a dangling Vercel domain?

HIGH SEVERITYHOSTINGCVSS 8.6Requires Account VerificationID: vercel

Vercel Dangling DNS & Takeover Fingerprint

A custom domain points via CNAME to Vercel edge routers, but no deployment is linked to this domain. Attackers can add the unverified domain to their own project.

DNS CNAME Delegation Rules

Target CNAME Delegation

*.vercel-dns.com / cname.vercel-dns.com

DNS Resolution Indicator

CNAME resolves to cname.vercel-dns.com. Edge returns 404: NOT_FOUND code: 'DEPLOYMENT_NOT_FOUND'.

Expected HTTP Status Code

404 Not Found

Authoritative Response Token

Vulnerable Body Indicator String

“404: NOT_FOUND”

CLI Verification Command

curl -sI http://subdomain.example.com | grep '404: NOT_FOUND'

When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.

Remediation Guide & Defensive Action Plan

Immediate Action Required: Delete the CNAME pointing to Vercel or link the domain in your verified Vercel team dashboard with team domain verification enabled.

Defensive Verification Checklist:

Audit authoritative DNS zone records for any CNAME pointing to *.vercel-dns.com / cname.vercel-dns.com.
Verify whether the target resource or bucket still exists under your organization's cloud tenant.
If decommissioned, delete the DNS record immediately to close the public exposure window.
Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.

Terraform Remediation Example

# Remove dangling Vercel alias or configure in Vercel provider
resource "vercel_project_domain" "subdomain" {
  project_id = vercel_project.app.id
  domain     = "subdomain.example.com"
}

Open Dedicated Vercel Terraform Solution Guide →

ATTACK SURFACE DETECTION COMPARISON

Why Static DNS Scanners Miss Vercel Takeovers

Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.

SubdomainWatch vs SecurityTrails →SubdomainWatch vs Detectify →All 5 Competitor Benchmarks →

Vercel Takeover FAQs

If your Vercel project was deleted and the domain was not claimed in a Vercel team with Domain Verification enabled, an external user can attempt to attach it. Vercel now encourages team-level verification to mitigate this.

FREE UNRESTRICTED SCANNER

Scan Your Domain for Vercel Orphans

Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.

LAUNCH TAKEOVER TOOL →Start Free 24/7 Monitor