I spent a year researching subdomain takeover attacks and automating both the offensive and defensive sides. This talk summarizes the impact and what it takes to get ahead of them.
Why takeovers keep happening
Subdomain takeovers are a bookkeeping failure more than a clever exploit. A DNS record outlives the resource it pointed at, someone else claims that resource, and now they own a hostname your users and your cookies still trust.
Automate the detection
The defence is continuous inventory: enumerate your DNS, resolve what each record actually points at, and alert on dangling references before someone else finds them. Doing this by hand does not scale past a few dozen records.
Make cleanup part of teardown
The durable fix is process: decommissioning a service includes removing its DNS. Detection catches what the process misses — it shouldn't be the only thing standing between you and a hostile host.