Question about Pantheon subdomain takeover feasibility after domain validation changes

[soy-elmago]

Hi,

I’m currently evaluating a potential subdomain takeover scenario involving a domain pointing to Pantheon, and I came across the update in the documentation regarding domain validation:

https://docs.pantheon.io/release-notes/2024/07/domain-validation

From what I understand, Pantheon now requires domain ownership verification via DNS TXT records before accepting traffic for a domain.

I’d like to confirm this before proceeding further, as testing would require setting up a paid plan.

Thanks in advance for your help!

[adityaax]

Based on the documentation, I would expect the subdomain takeover to be prevented now.

For example, in the past, if sub.example.com pointed to Pantheon and the original Pantheon site was deleted, an attacker could potentially create a new Pantheon site and claim that subdomain. However, if Pantheon now requires a DNS TXT record to verify ownership before a domain can be attached, the attacker would not be able to complete that step because they do not control the victim's DNS.