"Can I take over DNS?" — a list of DNS providers and how to claim vulnerable domains.

Now, the Host is Mine! - Super Fast Sub-domain Takeover Detection!

Dangling CNAMEs with this tool for subdomain takeovers

Mining SPF records for available Elastic IP addresses