A dangling DNS record is a DNS entry that still points to a removed, deleted, or deprovisioned resource. This often happens when a cloud service, storage bucket, or hosted app is retired but its DNS alias remains in place. The record may resolve to nothing, or it may point to a name that can later be claimed by someone else.
Security teams care about dangling DNS records because they can enable subdomain takeover and impersonation. If an attacker can register or reclaim the target service under the provider’s rules, they may serve content under a trusted organizational name, which can be used for phishing, credential theft, or malware delivery. Defenders reduce the risk by scanning for orphaned CNAME and similar records, tying DNS cleanup to asset decommissioning, and verifying that each hostname still maps to an owned, active service.