Dangling DNS is a DNS record that still points to a service, cloud resource, or hostname that has been deleted, moved, or no longer belongs to the original owner. The name remains in DNS, but the target behind it is gone or can be claimed by someone else.
This matters because DNS is part of trust on the internet. If an orphaned record points to a deprovisioned cloud endpoint, an attacker may be able to register the missing resource and receive traffic meant for the original domain. That can enable phishing, malware delivery, session interception, or brand impersonation. Defenders look for dangling CNAMEs, abandoned subdomains, and stale infrastructure during asset inventory and decommissioning. Good practice is to remove DNS entries when services are retired, verify ownership of every referenced cloud asset, and regularly scan for orphaned records before attackers do.