Discover subdomains for any domain using DNS enumeration.
Subdomains are prefixed namespaces under a main domain — like blog.example.com, api.example.com, or staging.example.com. Large organizations can have dozens or hundreds of them across dev, production, and third-party services.
Discovering all subdomains is critical for security audits. Forgotten or abandoned subdomains often run outdated software with known vulnerabilities, or expose staging environments to the public internet — giving attackers alternative entry points.
This tool uses DNS brute-force enumeration — it checks ~100 common subdomain prefixes (www, api, mail, staging, etc.) against your domain and reports any that resolve to an IP address.
It discovers hostnames under a domain using DNS enumeration patterns and public certificate transparency clues so you can audit attack surface and forgotten staging hosts.
Only scan domains you own or have explicit permission to assess. Unauthorized scanning of third-party infrastructure can violate laws and terms of service.
Private, unlisted, or internal-only names will not appear. Results depend on public DNS and certificate logs, not a complete inventory of every host.
Subdomains often host staging apps, admin panels, APIs, mail gateways, or forgotten marketing sites. This tool combines DNS enumeration patterns with certificate transparency clues to surface hostnames under a root domain you may not remember creating — a practical first pass for attack-surface and migration audits.
Each discovered name should resolve somewhere useful — or be removed. CNAME targets pointing at third-party vendors (SaaS, CDN, email) are normal; dangling CNAMEs that point at deleted cloud resources are high risk (subdomain takeover). Wildcard certificates can make many names appear “valid” even when little content is served.
dev. hosts left indexable and unauthenticatedblog. or shop. records after a platform migrationA company thought only www and mail existed. The finder revealed jenkins. and grafana. still answering on the public internet with default logins. Closing those DNS records and firewall rules removed an avoidable breach path before a customer audit.
No enumerator finds every private or unlisted hostname. Results depend on public DNS and CT data — not on scanning your internal network. Always verify ownership before probing hosts aggressively; this tool is for domains you control or have permission to assess.
What Are Subdomains? · SSL Checker · DNS Lookup · Website Health Check