First establish what changed
A CNAME maps one DNS name to another canonical name. When its target changes between two comparable zone exports, you have evidence of a configuration difference, not by itself of a compromise or subdomain takeover. Hosting migrations, application moves and vendor changes may intentionally change targets.
For example, suppose an authorized export comparison shows:
Before: docs.example.com. IN CNAME old-docs.example.net.
After: docs.example.com. IN CNAME new-docs.example.net.
The workspace reports the old record as removed and the new record as added. It does not infer the reason, whether either destination resolves or whether a third-party account can claim either endpoint.
Follow the evidence in order
- Check comparability. Were the same zone, DNS view and intended scope exported? Note collection times and warnings.
- Confirm current configuration. Compare the observed target against the authorized DNS provider's configuration.
- Review change control. Look for an approved migration, ticket or vendor handover that explains the target.
- Verify service ownership. Ask the responsible application or platform owner whether the old and new destinations are expected.
- Check dependencies. An old documentation link, authentication callback or application integration may still depend on the previous name.
- Record a decision. Mark the change expected, needing confirmation or a cleanup candidate, and preserve source evidence.
This is a documented investigation workflow, not a recommendation to probe systems outside your authority.
What if the target points to an external provider?
An external CNAME target is common in hosted applications. Its presence alone does not prove a takeover risk. If the organization no longer uses the vendor, validate the intended retirement with the service owner and follow the provider's documented removal procedure. Assessments involving third-party account-claim behavior require explicit authorization and provider-specific evidence.
Conversely, an unchanged CNAME does not establish the downstream service is healthy: the target's own DNS or application behavior could change without modifying the record you imported.
Use a review record, not an automatic verdict
A useful entry might be:
| Field | Example note |
|---|---|
| Observed name | docs.example.com |
| Prior target | old-docs.example.net |
| Current target | new-docs.example.net |
| Evidence | Two comparable authorized zone exports |
| Verification | Change ticket and service owner pending |
| Decision | Needs confirmation |
Record the final finding and owner in the review worksheet. For how hostname and value differences are normalized, read the methodology; for a broader change process, use the asset-change checklist.