Subdomain takeover is an attack where an attacker claims a dangling subdomain and then controls the content it serves. This usually happens when a DNS record, often a CNAME, still points to a cloud service or hosted app that has been deleted or deprovisioned. If the provider allows the name to be reused, the attacker can register the same target and make the old subdomain resolve to their own infrastructure.
This matters because the subdomain may still be trusted by users, browsers, or internal systems. Attackers can abuse it for phishing, cookie theft, malicious redirects, or impersonating a legitimate service. Defenders reduce the risk by removing DNS records when services are retired, scanning for orphaned entries, and checking provider-specific takeover conditions during decommissioning. In practice, subdomain takeover is a cloud lifecycle and DNS hygiene problem, not a flaw in DNS itself.