Detects when a CNAME target changes — the earliest signal of a broken CDN swap, subdomain takeover risk, or accidental alias edit.
Quick answer
Lemwatch tracks the CNAME target for every subdomain you monitor and alerts on any change. If the new target resolves to nothing, we flag a potential subdomain-takeover risk.
What it checks
CNAME chains up to 8 hops
Final resolved host and its A records
Whether the target returns NXDOMAIN (takeover signal)
Cross-region resolution to filter DNS propagation noise
Where to find it in Lemwatch
Site details → Health → DNS tab. Takeover-risk changes also raise an incident with severity: high.
How to respond
Compare old vs new target in the DNS tab.
If new target is NXDOMAIN, remove the CNAME immediately.
Confirm the intended vendor now owns the target.
Re-issue TLS certs if the new host uses a different SNI.
Acknowledge once verified.
FAQ
What is a subdomain takeover?
An attacker claims an abandoned CNAME target (e.g. an old Heroku app) and serves content under your domain.