Subdomain Discovery
Discover active subdomains via DNS brute-force enumeration.
Free · No sign-up · Use it instantly
Subdomain Discovery Scanner
Discover active subdomains for any domain using DNS brute-force enumeration.
01 / How it works
Understanding Subdomain Discovery Results
Subdomain discovery queries common host records (e.g., mail, blog, dev, api) against DNS resolvers. If subdomains resolve to IP addresses, they are active. Discovering active hosts helps audit your attack surface.
The Complete Guide to Subdomain Discovery and Security
What is Subdomain Discovery?
Subdomain discovery is the process of identifying active subdomains for a target domain. Security auditors use this to map a company's external attack surface and identify forgotten or staging servers.
Brute-Force vs. Passive Enumeration
- Passive Enumeration: Queries public Certificate Transparency (CT) logs and search engine indexes without directly interacting with target servers.
- Active (Brute-Force) Enumeration: Queries DNS resolvers directly for common subdomain prefixes (e.g.,
api.example.com,stage.example.com) and filters for positive responses.
Securing Subdomains
Forgotten subdomains pointing to expired external services can be hijacked by attackers, a vulnerability known as Subdomain Takeover. Regularly audit active DNS records to prevent takeovers.
02 / FAQ
Questions, answered.
What is a subdomain takeover?
This occurs when a subdomain points to an external service (like GitHub Pages) that has been deleted, allowing an attacker to claim it.
How do I prevent subdomain takeovers?
Regularly audit DNS zones and remove CNAME or A records pointing to expired third-party resources.
Is active subdomain scanning noisy?
Yes. Brute-forcing DNS queries generates network traffic. Use passive scanning options where possible.
What are Certificate Transparency (CT) logs?
Public logs of all issued SSL certificates, used by security teams to passively discover new subdomains.
Why do subdomains resolve to distinct IP addresses?
Companies host services (like billing, mail, and APIs) on separate servers or CDNs for isolation.
What does a wild card DNS record do?
A wildcard record (*.example.com) maps all queried subdomains to a single fallback IP unless overridden.
Can I scan internal subdomains?
No, our tool only discovers subdomains that are publicly resolvable in public DNS.
How does DNS caching affect discovery?
Resolvers cache negative DNS query answers (NXDOMAIN). The tool bypasses this by querying authoritative nameservers directly.
04 / Guides
Read next.
Ready when you are
Finished preparing your project?
Deploy it from Git with automatic builds, HTTPS and rollbacks on Deployxa.