Subdomain Takeover Auditor — Find Claimable DNS Records
Find dangling DNS records pointing at decommissioned third-party services — the kind anyone can claim to hijack a subdomain of your brand for phishing. Discovers subdomains passively from certificate transparency, resolves CNAMEs, and confirms matches against a public takeover-fingerprint database.
Subdomain Takeover Auditor — Find Claimable DNS Records returns 12 documented output fields, including subdomain, apexDomain, resolves, dnsStatus and cname. Every field carries a declared type, a written description and an example value. 27 runs are recorded on Apify.
- 12
- Output fields
- 6
- Inputs
- 27
- Runs
- 2026-10-15
- Last run
01 — output
What it returns
Every field the extractor writes to its dataset, with its type, a written description and an example value.
| Field | Type | What it holds | Example |
|---|---|---|---|
| subdomain | stringnull | The subdomain portion, excluding the registered domain. | <subdomain> |
| apexDomain | stringnull | Registered domain, with any subdomain removed. | <apexDomain> |
| resolves | booleannull | Whether the hostname resolved in DNS. | true |
| dnsStatus | stringnull | Outcome of the DNS lookup. | <dnsStatus> |
| cname | stringnull | CNAME target for this name. | <cname> |
| matchedService | stringnull | Service that matched. | <matchedService> |
| risk | stringnull | Risk assessment for this row. | low |
| verdict | stringnull | The Actor's conclusion for this row, stated in words. | pass |
| confidence | stringnull | How confident the Actor is in this result, from 0 to 1. Not a probability of correctness. | <confidence> |
| checkedAt | stringnull | ISO 8601 timestamp of the most recent check. | 2026-10-16T09:12:44.000Z |
| status | stringnull | Outcome recorded for this row. | ok |
| subdomainsChecked | integernull | How many subdomains were checked. | 18 |
02 — sample
One record
Assembled from the example values declared on the schema above, not invented at render time.
{
"subdomain": "<subdomain>",
"apexDomain": "<apexDomain>",
"resolves": true,
"dnsStatus": "<dnsStatus>",
"cname": "<cname>",
"matchedService": "<matchedService>",
"risk": "low",
"verdict": "pass"
}03 — input
What you give it
| Input | Type | Description |
|---|---|---|
| domains | arrayoptional | Apex domains to audit, e.g. yourcompany.com. Subdomains are discovered automatically from public certificate transparency logs — you do not need to list them. |
| maxSubdomainsPerDomain | integeroptional | Cap on how many discovered subdomains to check per domain. |
| confirmWithPageCheck | booleanoptional | For a CNAME that matches a known-vulnerable service, fetch the page once to confirm the takeover fingerprint. Without this, matches are reported as 'suspicious' rather than 'claimable' — turning it off is faster but less certain. |
| onlyRisky | booleanoptional | Return only claimable and suspicious subdomains. Turn off to get every subdomain checked, including the ones that are fine — useful for a full inventory. |
| concurrency | integeroptional | How many subdomains to check at once. |
| maxItems | integeroptional | Hard cap on rows returned. You are never charged beyond this. |
04 — run
Run Subdomain Takeover Auditor on your own input
It runs in the cloud on Apify. Nothing to install, and you are billed per result returned rather than per attempt.
05 — questions
Asked before running it
12 of 12 fields described
- What does Subdomain Takeover Auditor — Find Claimable DNS Records return?
- It returns 12 documented output fields: subdomain, apexDomain, resolves, dnsStatus, cname, matchedService, risk, verdict, confidence, checkedAt, status and subdomainsChecked. Each field declares its type, a description of what it holds, and an example value.
- What input does Subdomain Takeover Auditor — Find Claimable DNS Records take?
- All 6 inputs are optional and ship with usable defaults, so it runs as-is. They are listed with their types below.
- Does Subdomain Takeover Auditor — Find Claimable DNS Records need an API key or login?
- No. None of its inputs is a credential, and it reads only public data. Nothing to sign up for before the first run.
- How do I run Subdomain Takeover Auditor — Find Claimable DNS Records?
- It runs on Apify. Start it from its listing with the inputs above, or call the Apify API with the Actor's ID. Results land in a dataset you can export as JSON, CSV or Excel, or read through the Apify API into your own pipeline.