I'd like to know what are the risks having a subdomain managed by third party. For example, I manage my own DNS servers to serve mydomain.example which provide some internal and public content. If I develop a Cloud app on a Cloud provider and I want the domain for this app served by this Cloud provider, let's say sub.mydomain.example, what are the risks introduced to mydomain.example ? It could be takeover, reputation for the whole mydomain.example, or anything else ? Or maybe would it be preferable to serve sub.mydomain.example from my own DNS servers ?


Not directly: you can always revoke the delegation

DNS is a hierarchical system, where delegation of control is always given from the top to the next level. I like this illustration from SophieDogg's article An Intro to DNS, because it recognize that some domains like bbc.co.uk are already from the same level of delegation than sub.example.com:

SophieDogg: Hierarchial View of the Domain Name System

Therefore, if sub.example.com could affect example.com or another.example.com, all *.co.uk would be automatically in danger, too. Just like when your domain expires and the registrar managing .com domains is allowed to remove your delegation over example.com from the com name servers, you are at any time allowed to revoke the delegation over any sub.example.com simply by removing the NS records from the parent zone.

However, there are some indirect risks

Unlimited control over the whole subtree

This is rather obvious, but you can't control the level of subdomains below the delegated subtree: if someone controls sub.example.com, he also controls *.sub.example.com *.*.sub.example.com and so on.

Remember that if someone controls the DNS, it's possible to add all type of records, whereas if you controlled it you could limit these possibilities e.g. only to A records. In addition, it's possible to return different answers to different clients, making it harder to debug issues or detect abuse.

Subdomains with special functions

You shouldn't allow registration of arbitrary subdomains, as some subdomains may have special use defined in a protocol. That kind of subdomains can affect the whole parent domain. E.g.

Carefully limit the allowed namespace!

Protocols with cached properties

This is essentially the same question than how a former owner of a domain can affect the domain you have just purchased. HTTP Strict Transport Security (HSTS, RFC 6797) is a feature that is cached for a long time, and if someone enables HSTS on the domain, it can only be disabled over trusted (valid certificate) HTTPS on the next connection. HTTP-Based Public Key Pinning (HPKP, RFC 7469) was removed from Chrome partly for the same reasons i.e. the risk of denial of service and hostile pinning.

Problems within this category, as well as web site related problems like cookies that can be used from subdomains (domain=.example.com) aren't related to DNS delegation, but letting someone else use the subdomain on other protocols. Therefore, the same issues would exist even if you didn't delegate the control of the subdomain to 3rd party name servers.

Subdomain takeovers

The phenomenon is thoroughly explained in HackerOne's Guide to Subdomain Takeovers. An abandoned subdomain could be used for malicious activities or a removed subdomain formerly in use could be re-registered to gain control over something someone else has forgotten behind. This can be prevented by disallowing re-use altogether or by applying long enough protection periods.

  • Thank you Esa for your reply. I read that main risks are : 1) session leakage through cookies when they are valid for the wholemydomain.example and not only for sub.mydomain.example 2) Script injection on sub.mydomain.example may have consequences on mydomain.example 3) Cookie fixation if evil.mydomain.example sets a non host-only cookie at mydomain.example that my domain believes. Are there any other risks I didn't see? And is there any possibility to take control over mydomain.example managed by own DNS on-prem when sub.mydomain.example is managed by a Cloud provider? – Esendee Jul 28 '20 at 22:01
  • I focused a bit more on the problems related to DNS delegation, as it gives full power over the subtree. The web site related security issues would exist despite you fully controlled the DNS. No, on DNS level you can't affect parent zone: as explained in the answer, if sub.example.com could compromise example.com, also example.com could compromise com. – Esa Jokinen Jul 29 '20 at 0:29
  • 1
    You can have a look at tools.ietf.org/html/rfc8552 for a registry of underscore labels. – Patrick Mevzek Jul 29 '20 at 15:40
  • @PatrickMevzek: It would be so nice if special subdomains were limited to these underscore labeled, registered names! I found the autodiscover, but I bet there's more. Can you perhaps help me by adding some other unregistered, widely used subdomains? I mean those that are used in an automated manner and could easily be abused. – Esa Jokinen Jul 29 '20 at 15:51
  • 1
    wpad is a pretty devastating example: nakedsecurity.sophos.com/2016/05/25/…. but this is also mostly due in the underlying OS poor use of the DNS (it shouldn't recurse up to the root but would have to use something akin to the PSL to know where are the administrative boundaries, an unsolved problem in DNS land even today) – Patrick Mevzek Jul 29 '20 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.