A CNAME under the primary domain points at a SaaS platform the company stopped paying for in 2024. Nobody knows who created it or what it served. This is the most common finding in a mature estate and it is treated as housekeeping far too often.
Establish the risk first
dig +short CNAME portal.calderandvoss.com
-> cv-prod.someplatform.example
dig +short A cv-prod.someplatform.example
-> (nothing)
The question that decides everything:
Can somebody register "cv-prod" at that platform?
yes -> CRITICAL. They serve content on
portal.calderandvoss.com, obtain a valid
certificate for it, and set cookies scoped
to your domain.
no -> a dead record. Tidy it up.
Check the platform's sign-up: is the name still
available, and does claiming a name of your choosing
attach it to a hostname?Establish whether it was already claimed
- Search CT for the hostname. A certificate issued for
portal.calderandvoss.comthat you did not request means somebody already passed domain validation for it — which means the takeover has happened. - Check passive DNS. If the target resolved to an address during a period after the subscription ended, somebody was serving from it.
- Capture before removing. The record pointing at claimable infrastructure is the evidence. Removing it first destroys the proof while an attacker keeps any certificate they obtained.
Who created it
Usually unanswerable, and usually not worth the hours. The productive version of the question is how did this survive: a subscription cancelled by somebody with no reason to think about DNS, and nothing in the offboarding process that mentioned a record. That is the finding — the record is the symptom.
One dangling record means there are others
The process that allowed this one allowed all of them. Resolve every CNAME, NS and MX target in the zone before writing the finding up, so the report says “four dangling records and the process that produced them” rather than “a dangling record”.