Securing Subdomains Against DNS Spoofing and Subdomain Takeovers

Stale CNAME records pointing to decommissioned external services (like abandoned GitHub Pages, S3 buckets, or Heroku apps) leave your infrastructure vulnerable to subdomain takeovers, where malicious actors claim the dangling endpoint.

Regularly auditing your DNS zones and cleaning up dangling CNAME entries should be a mandatory part of any security reconnaissance check. What tools do you use to automate DNS enumeration and vulnerability audits?