Cybersecurity glossary
What is a Subdomain?
Learn what a subdomain is, how DNS labels nest under a domain, common uses like app and api hosts, and security risks such as subdomain takeover and cookie scope issues.
Definition
A subdomain is a DNS name that sits under a parent domain—for example api.example.com under example.com—created by adding one or more labels to the left of the parent name to identify a specific host, service, or site.
Why subdomains matter
Organizations rarely run everything on one hostname. Marketing sites, APIs, staging, and SaaS integrations each get names under the corporate domain. Those subdomains are convenient—and they expand the attack surface.
Understanding subdomain structure is essential for certificate design, cookie scope, and takeover prevention.
Where a subdomain sits in DNS
| Example name | Role |
|---|---|
| com | Top-level domain (TLD) |
| example.com | Registered domain (often SLD + TLD) |
| api.example.com | Subdomain for an API service |
| us.api.example.com | Deeper subdomain (additional labels) |
Common uses
Service separation
api., auth., cdn., and status. hosts for clear routing.
Environment isolation
staging. and dev. names (handle carefully—do not leak).
Regional endpoints
Geo-specific or tenant-specific hostnames.
Delegated platforms
CNAMEs to SaaS vendors for docs, mail, or support.
Security pitfalls
Create many DNS aliases
Teams point subdomains at cloud apps, buckets, and PaaS hosts.
Decommission without cleanup
The cloud resource is deleted but the DNS record remains.
Attacker claims the dangling target
They provision the same vendor resource name and serve content.
Trust is abused
Users and cookies may treat the hijacked subdomain as yours.
- Inventory all subdomains continuously (CT logs, DNS enumeration, asset tools).
- Remove DNS records when cloud resources are decommissioned.
- Prefer vendor verification records over long-lived dangling CNAMEs.
- Scope cookies tightly; avoid Domain=.example.com unless necessary.
- Treat each subdomain as its own origin and trust boundary.
- Use appropriate certificates (SAN or wildcards) and monitor expiry.
- Lock down staging subdomains with auth and network controls.
- Monitor Certificate Transparency for unexpected subdomain issuance.
The practical takeaway
A subdomain is a named host under your domain. It enables clean architecture—and creates takeover, cookie, and certificate responsibilities.
Manage subdomains like production assets: inventoriable, owned, and deleted when unused.
Related security terms
Domain Name System (DNS)
The system that resolves subdomain names to addresses.
Second-Level Domain (SLD)
The label typically registered under a TLD (example in example.com).
Top-Level Domain (TLD)
The rightmost DNS label such as .com or .org.
Wildcard Certificate
Certificates that can cover many subdomains under one name.
Frequently asked questions
What is a subdomain in simple terms?
It is a named branch of your domain, like blog.example.com or shop.example.com, pointing to a specific service.
Is www a subdomain?
Yes. www.example.com is a subdomain of example.com, even though it is often treated as the “main” site.
Who creates subdomains?
Domain owners (or their DNS admins) create DNS records—A, AAAA, CNAME, etc.—for each subdomain label.
What is subdomain takeover?
When a DNS record points to a deprovisioned cloud resource that an attacker can claim, serving content under your subdomain.
Do cookies apply to all subdomains?
Cookie Domain attributes can share cookies across subdomains. Mis-scoped cookies can expand XSS or session impact.
Are subdomains separate security origins?
In browsers, different hostnames are different origins (scheme+host+port). Subdomains do not automatically share DOM access.
References
Explore authoritative guidance and frameworks related to subdomain.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.