How it works
Once a day, we go through every host name of your domain we know of: the ones found in Certificate Transparency logs by the New certificates check, up to 100. For each one, we follow its CNAME record and check whether the target still exists.
When a subdomain points to a service you no longer use, such as a deleted Heroku app, Azure site, S3 bucket or Shopify store, anyone can sign up for that service under the same name. They then serve their own content on your subdomain, with your domain's reputation and cookies. Attackers scan for these around the clock.
Statuses
| Status | Meaning |
|---|---|
| OK | No subdomain points to a missing target. |
| Failed | A subdomain has a CNAME to a target that does not resolve. The report lists each one with its target. |
By default you are notified of warnings and failures.
Fixing common problems
- Remove the CNAME record of every subdomain you no longer use. This is the whole fix.
- Still using it? Recreate the service at the same target, then fix whatever deleted it.
- Prevention: when you shut down a service, delete its DNS record first.