An abandoned service can leave an active relationship to your domain long after the business stops using it. Review that relationship as an ownership problem: identify the DNS name, the resource it points to, who can bind that resource and what mail capability the dependency actually grants. A stale web alias is not automatically an ability to send aligned email.
Trace the complete dependency
Start with an authorized inventory export, not a scan for resources you could claim. Record the DNS owner name, record type, target, service account, business owner and last verified use. Microsoft describes how dangling DNS entries can create subdomain-takeover risk when referenced resources disappear. Its Azure-specific prevention mechanisms should not be assumed to exist at another vendor. Microsoft guidance.
Separate CNAME hosting, delegated DNS zones, DKIM selector delegation and SPF authorization. These relationships grant different capabilities. A service hosting a page at news.brand.test does not necessarily possess a signing key for brand.test. Conversely, an obsolete selector delegation can leave an authentication dependency even when no visible website remains. Inventory the effective authority rather than grouping everything as a domain takeover.
Establish the mail boundary
DMARC evaluates authenticated identifiers in relation to the message's author domain. A policy result does not establish whether the organization still intends a third party to have that authority. RFC 9989. Preserve the exact From, envelope and signing domains from an authorized sample if mail is involved. Use trusted receiver evidence, and distinguish a valid signature from an approved business sender.
A missing resource is an investigation lead. Claimability may depend on provider verification, retained reservations and account state. Do not claim an external resource to prove the point without explicit authorization. Ask the accountable service owner to confirm retirement and consult current provider guidance. Uncertainty belongs in the record, not in an accusation that a takeover has happened.
Work through a written dependency ledger
Assume three CNAME rows in a hypothetical authorized inventory. The targets are reserved example names, not live provider resources.
- news.brand.test points to retired-service.example.test. Resource retirement and marketing-owner confirmation are stipulated. Propose removal only after checking other dependencies and obtaining actual change approval; claimability and mail authority remain untested.
- alerts.brand.test points to active-service.example.test. Resource and operational owner are assumed active. Retain the mapping and verify its intended use; activity does not by itself prove safe isolation or domain ownership.
- unknown.brand.test points to uncertain-service.example.test. Resource status and owner are unknown. Assign investigation, not a compromise finding or a safe-to-delete conclusion.
No code reconciled these rows, no public DNS was queried and no resource was claimed. The written next actions depend on stipulated facts. Replace them with dated inventory and owner evidence in a real change. Keep CNAME hosting, SPF authority and DKIM delegation as separate inventory types rather than deriving mail capability from a web alias.
Retire dependencies in a controlled order
Agree the retirement sequence with the DNS and service teams. Confirm that the mapping no longer supports mail, websites, verification challenges or another live dependency. Remove or change the domain relationship through the approved change process, then verify the authoritative DNS and any affected message routes. Preserve a recovery plan for an accidental removal, while avoiding an indefinite stale delegation as the rollback strategy.
Close the case with the observed relationship, ownership confirmation, exact approved change and verification time. Keep unresolved provider behavior explicit. A recurring reconciliation between DNS records and the service inventory is more useful than a one-time list of alarming names. The objective is to remove unnecessary authority without interrupting a legitimate route.