BUILDING TO PREVENT SUBDOMAIN TAKEOVERS

Summary from the TLDR InfoSec newsletter

This blog post discusses architectural decisions that can be made by platforms offering custom domains to proactively prevent subdomain takeovers. The most common mitigation method employed is requiring domain verification, which is most commonly implemented as a TXT record with a verification string. Other mechanisms suggested are to add entropy to the underlying record to make it difficult to generate an identical record, preventing the re-registration of custom domains, and charging for custom domains.