I'm prepared to be proven wrong, but I think it's no longer possible to perform a subdomain takeover on a CNAME pointing to an Azure Front Door.
Old SKUs (.azurefd.net) are disallowed, and new SKUs (-.a01-3/z01-3.azurefd.net) require the hash, which requires ownership.
Old SKUs (
Comments