All Tools

Subdomain Finder

Discover subdomains for any domain using DNS enumeration.

Subdomains are prefixed namespaces under a main domain — like blog.example.com, api.example.com, or staging.example.com. Large organizations can have dozens or hundreds of them across dev, production, and third-party services.

Discovering all subdomains is critical for security audits. Forgotten or abandoned subdomains often run outdated software with known vulnerabilities, or expose staging environments to the public internet — giving attackers alternative entry points.

This tool uses DNS brute-force enumeration — it checks ~100 common subdomain prefixes (www, api, mail, staging, etc.) against your domain and reports any that resolve to an IP address.

google.comgithub.com
Want the full picture?
Run a free Website Health Check →

Common questions

It discovers hostnames under a domain using DNS enumeration patterns and public certificate transparency clues so you can audit attack surface and forgotten staging hosts.

Only scan domains you own or have explicit permission to assess. Unauthorized scanning of third-party infrastructure can violate laws and terms of service.

Private, unlisted, or internal-only names will not appear. Results depend on public DNS and certificate logs, not a complete inventory of every host.

What the subdomain finder does

Subdomains often host staging apps, admin panels, APIs, mail gateways, or forgotten marketing sites. This tool combines DNS enumeration patterns with certificate transparency clues to surface hostnames under a root domain you may not remember creating — a practical first pass for attack-surface and migration audits.

When to enumerate subdomains

  • Before a security review or penetration test scope
  • When retiring a brand or merging products onto one domain
  • After leaving an agency or hosting provider that may have created hosts for you
  • To find staging systems accidentally exposed to the public internet

How to interpret findings

Each discovered name should resolve somewhere useful — or be removed. CNAME targets pointing at third-party vendors (SaaS, CDN, email) are normal; dangling CNAMEs that point at deleted cloud resources are high risk (subdomain takeover). Wildcard certificates can make many names appear “valid” even when little content is served.

Common issues

  • Staging or dev. hosts left indexable and unauthenticated
  • Old blog. or shop. records after a platform migration
  • Dangling CNAMEs after cancelling Heroku, Azure, or GitHub Pages
  • Internal tool hostnames that leak naming conventions

Example scenario

A company thought only www and mail existed. The finder revealed jenkins. and grafana. still answering on the public internet with default logins. Closing those DNS records and firewall rules removed an avoidable breach path before a customer audit.

Limitations

No enumerator finds every private or unlisted hostname. Results depend on public DNS and CT data — not on scanning your internal network. Always verify ownership before probing hosts aggressively; this tool is for domains you control or have permission to assess.

Related resources

What Are Subdomains? · SSL Checker · DNS Lookup · Website Health Check