DNS

Subdomain Scanner

Subdomain Discovery

Scan for Subdomains

Enter a domain name and select scan type to discover active subdomains

Tool features

Comprehensive subdomain discovery and analysis
4 checks

Subdomain Discovery

Discover active subdomains and their configurations

Security Analysis

Analyze subdomain security and SSL configurations

Comprehensive Scanning

Multiple scan types from quick to comprehensive analysis

Detailed Reports

Get detailed information about each discovered subdomain

What is subdomain discovery & how it works

Finding the hosts that make up your attack surface

A subdomain is any hostname under your domain, such as mail.example.com or staging.example.com. Organisations accumulate them over years, and forgotten ones (old staging sites, retired services, dangling CNAMEs) are a common way into otherwise well-protected infrastructure.

DNS has no public "list all names" query, so this scanner tests a wordlist of common subdomain names against your domain. Each name that resolves is reported with its IP or CNAME target, then probed over HTTPS for its status code, server header, page title and detectable technologies.

Wordlist scan
Tries common names (www, mail, api, dev…) and keeps the ones that resolve.
CNAME
An alias to another hostname; one pointing at a deleted service risks takeover.
Attack surface
Every reachable host an attacker could probe; smaller is safer.

How to use this tool

Map a domain’s subdomains in four steps
1
Enter your domain
Type the root domain you own or are authorised to test, e.g. example.com.
2
Choose a scan type
Common is fastest, Security-focused targets admin, login and security-related names, and Comprehensive works through every wordlist category.
3
Run the scan
Each name is resolved in DNS, and hosts that exist are probed over HTTPS.
4
Review what you find
Check every live host is expected, patched and still in use; remove DNS records for anything retired.

Related tools

Keep debugging with tools from the same suite
4 tools
DNS Lookup
Perform DNS queries for A, AAAA, MX, TXT, CNAME, and other DNS record types
Domain Health Checker
Full domain audit report covering DNS, DNSSEC, WHOIS, SSL/TLS, security headers, CDN, IPv6, HTTP/2 & HTTP/3, blacklists, DNS propagation and email authentication
All DNS Records
Check all DNS records for a domain in one comprehensive scan including all record types
WHOIS Lookup
Get comprehensive domain registration information, registrar details, nameservers, and expiry dates

Frequently asked questions

Common questions about subdomain scanning
5 Q&A

It resolves a wordlist of common subdomain names against your domain and reports the ones that exist. It does not use zone transfers or certificate logs, so unusually named hosts may not appear; the Certificate Transparency tool can reveal names that have had certificates issued.

Only names in the wordlist are tried. Hosts with unique names, or those only resolvable on an internal DNS server, will not be found.

A CNAME that still points at a cloud service (a storage bucket, app platform or CDN) you no longer use. If someone else claims that resource, they can serve content on your subdomain. Delete DNS records when you retire the service they point to.

The scan only makes ordinary DNS lookups and HTTPS requests, but you should only scan domains you own or have permission to test.

Yes. With a wildcard (*.example.com) every name resolves, so the scan will report many hosts that are really the same wildcard target. Compare the IPs to spot this.