A DNS record pointing at somewhere that is no longer yours. Typically a CNAME on a subdomain aimed at a hosted service — a help centre, a landing page builder, a status page — after the account was cancelled.
Why it is more than untidy
With several providers, the name you released can be claimed by another account. Whoever claims it controls what is served at your subdomain, on your domain, often with a valid certificate the provider issues automatically.
The practical consequences are phishing hosted genuinely by you, and access to anything your main site scopes to the parent domain.
How they appear
Creating the record and cancelling the service are separate actions done at different times, often by different people. Nothing breaks visibly when the service goes away, so nobody investigates.
Fixing one
Delete the DNS record. That is the whole fix. If you still want the subdomain, point it at something you control first, then remove the old target — never leave a gap.
This is the short version. The full guide covers it properly: read more.