Scanner, checker & enumeration guide
How to Find and Check Subdomains of a Domain
Learn how online subdomain finders, scanners, and DNS checks differ; when to use passive or active methods; and how to turn a hostname list into useful infrastructure context.
The foundation
What is subdomain enumeration?
Subdomain enumeration is the process of discovering hostnames beneath a registered domain.
If the root domain is example.com, hostnames such as
api.example.com, docs.example.com, and
staging.example.com are subdomains.
Those names often map different services, environments, regions, or third-party platforms. Building an inventory helps teams understand their public footprint, find assets missing from internal records, and decide which systems need an authorized follow-up review.
A discovered hostname is a lead. It is not proof that the asset is owned by the expected organization, currently reachable, vulnerable, or within your testing scope.
The terms, explained
Subdomain finder, scanner, checker, and enumerator: what is the difference?
These labels are often used interchangeably in search results, but they do not always describe the same behavior. The important question is what a tool actually discovers, validates, and reports—and whether it sends traffic to the target.
| Term | Typical job | Important limitation |
|---|---|---|
| Subdomain finder | Discovers known hostnames beneath a root domain from one or more sources. | No public source can guarantee every private, new, or unobserved name. |
| Subdomain scanner | May combine discovery with active DNS, HTTP, port, or service probes. | The word scanner does not prove which checks are performed; verify the method and scope. |
| Subdomain checker | Validates a supplied or discovered hostname, commonly through DNS or HTTP responses. | A DNS answer does not prove that a website is reachable, healthy, or secure. |
| Subdomain enumerator | Systematically builds a hostname inventory by combining passive and authorized active methods. | Coverage depends on the sources, wordlists, freshness, authorization, and validation steps. |
SubdomainFinder is best described as a browser-based finder with DNS checks and network enrichment. It discovers candidate hostnames, resolves returned names, and shows DNS, IP or hostname, ASN, country, provider, and DNS-status context. It does not claim to scan ports, test application security, or prove that a hostname is vulnerable.
Common use cases
Who uses subdomain discovery?
Asset owners & blue teams
Compare public hostnames with the official inventory and investigate forgotten or unmanaged assets.
Developers & operations
Trace DNS aliases, hosting networks, regional endpoints, migrations, and third-party dependencies.
Authorized security testers
Map in-scope hosts before deeper testing and export a clean list for repeatable, approved workflows.
Incident responders & OSINT teams
Correlate names, addresses, networks, and DNS records during a time-sensitive investigation.
Discovery approaches
Passive vs active subdomain enumeration
Enumeration is not a single technique. Good coverage usually comes from combining methods whose observations, freshness, and level of target interaction differ.
Passive discovery
Searches information that has already been collected, so it usually avoids sending discovery probes to the target itself.
- Certificate Transparency records
- Passive DNS and historical datasets
- Search indexes and web archives
- Public code, documentation, and datasets
Trade-off: coverage depends on what each source has observed.
Active discovery
Tests candidate names or interacts with DNS and web infrastructure. This can create traffic visible to the asset owner.
- Wordlist-based DNS resolution
- Permutations of known hostnames
- Authorized crawling and service checks
- Zone-transfer checks where permitted
Trade-off: use only with clear authorization and scope.
Common discovery signals
Certificate Transparency
Publicly trusted certificates are recorded in auditable logs. Certificate names can reveal hosts that requested TLS certificates, although wildcard certificates and unencrypted services can leave gaps. Learn how the Certificate Transparency ecosystem works.
DNS records and aliases
A, AAAA, and CNAME answers connect names to addresses or other hostnames. DNS is distributed and changes over time, so resolution is best treated as a point-in-time observation. The IETF DNS concepts specification explains the underlying namespace and resource-record model.
Historical and indexed sources
Archives, passive DNS providers, search engines, and public datasets may preserve names no longer present in current DNS. Historical results are useful for leads but can be stale. For a separate history workflow, search historical website snapshots with WebArchive.
Candidate generation
Authorized active tools can test common labels and variations of known names. Wildcard DNS must be detected or it can make nonexistent candidates look valid.
Using SubdomainFinder
How to find and check subdomains of a domain
To check subdomains online, start with the root domain, review the discovered hostname list, then validate the DNS and network signals that matter to your authorized scope. SubdomainFinder is designed for this quick first pass without installing a command-line tool. It sends the submitted domain to its discovery service, then resolves returned hostnames and adds DNS and network context to the visible results. The discovery service's source mix is not documented in this frontend, so the output should be treated as best-effort rather than exhaustive.
-
1
Confirm authorization
Check ownership, the written scope, excluded assets, rate limits, and rules of engagement.
-
2
Enter the root domain
Use a hostname such as
example.com, without a protocol, path, port, or query string. -
3
Filter and prioritize
Sort or search the table for relevant environments, services, providers, or naming patterns.
-
4
Inspect DNS context
Open the DNS view to review A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, and SRV answers observed at lookup time.
-
5
Export and verify
Copy or export the filtered names, then compare important findings with internal records and another authorized method.
No installation required
Ready to check an authorized domain?
Interpretation
How to read SubdomainFinder results
The enrichment columns help you triage a hostname list. They are indicators, not final conclusions; CDN edges, shared hosting, DNS caching, and rapid changes can all affect what appears.
| Field | How to interpret it | Important limitation |
|---|---|---|
| Subdomain | A hostname returned by the discovery service. | Presence does not prove current ownership or scope. |
| IP / Hostname | The displayed address or alias from DNS resolution. | An alias chain or multiple answers may exist. |
| Country / ASN | Network metadata associated with the resolved IP. | A CDN edge may not reveal the origin's location or network. |
| Type | The answer is commonly A, AAAA, or CNAME. | Other record types can still exist in the DNS view. |
| Cloudflare / Akamai | Heuristic signals based on known network ranges or aliases. | These are useful hints, not authoritative provider confirmation. |
| DNS Status | A usable DNS answer was observed by the resolver. | It is not an HTTP, HTTPS, uptime, or vulnerability check. |
| DNS | Opens additional record answers returned at lookup time. | Answers can differ by resolver, geography, cache, and time. |
Example interpretation
This hypothetical row says that api.example.com aliases another hostname and
resolved when checked. It does not show whether an HTTPS service is healthy, whether the origin
sits behind that alias, or whether the host is safe to test.
Accuracy
Can you find all subdomains of a domain?
No. A public subdomain finder cannot guarantee every hostname. Private DNS, newly created assets, names never observed by a source, wildcard certificates, wildcard DNS, and stale historical records can all create gaps or misleading leads.
Incomplete by nature
Discovery sources observe different slices of the internet. Absence from results is not proof that a name does not exist.
DNS is time-sensitive
Records, addresses, and aliases can change between searches because of deployments, failover, and cache lifetimes.
Resolution is not uptime
A hostname can resolve while its application is unavailable, restricted, or hosted on a non-web protocol.
Network context is indirect
ASN, country, and CDN signals describe the observed address path, which may be shared or proxy the origin.
For an asset inventory, reconcile results with authoritative DNS, cloud accounts, certificate management, source control, CMDB records, and another discovery method. For an assessment, retain the written scope alongside the exported list.
Tool selection
Which online subdomain finder or scanner should you use?
The best choice depends on whether you need a quick answer, repeatable automation, deep attack-surface mapping, or one specific data source. Mature workflows often combine more than one.
| Approach or tool | Best fit | Main trade-off |
|---|---|---|
| SubdomainFinder | Fast browser-based first pass with DNS context, filtering, and export. | Best-effort coverage; source methodology should be documented by the operator. |
| Certificate search / crt.sh | Inspecting names recorded in publicly logged certificates. | Misses names without public certificates; historical entries can be stale. |
| Subfinder | Repeatable passive CLI discovery in scripts and security pipelines. | Requires installation and some sources may need API configuration. |
| OWASP Amass | Deeper external asset discovery, correlation, and attack-surface mapping. | More setup, time, data sources, and operational complexity. |
| Commercial ASM platforms | Continuous monitoring, ownership workflows, integrations, and reporting. | Cost, procurement, configuration, and a broader workflow than one-off lookup. |
An online finder is useful for a one-off lookup, readable results, and quick DNS context. A CLI tool such as Subfinder is usually a better fit for repeatable passive workflows, while OWASP Amass suits deeper correlation and attack-surface mapping. Calling a product a scanner does not make its coverage complete, so compare documented sources, validation behavior, freshness, export options, and limits.
Quick answers
Frequently asked questions
How do I get a list of subdomains?
Run an authorized search for the root domain, filter the returned hostnames, then copy or export the results for review. Treat the list as best-effort and compare important assets with authoritative DNS, cloud inventory, and another discovery method.
How do I find subdomains of a domain online?
Enter the root domain without a protocol or path, review the returned hostnames, and inspect their DNS answers. Filter or export the list, then compare important results with your authoritative DNS, cloud inventory, or another authorized discovery method.
What is the difference between a subdomain finder, scanner, and checker?
Not necessarily. A scanner may actively test candidates or services, while a checker may only validate DNS or HTTP status for known names. Read the tool's documented method instead of relying on the label.
Can any tool find all subdomains of a domain?
No. Coverage is best-effort and depends on the discovery service and what its sources have observed. Private, new, unobserved, or historical names can be missing or stale.
What is the difference between passive and active enumeration?
Passive enumeration searches previously collected information. Active enumeration tests or queries candidate infrastructure and can create traffic visible to the target.
What does an “online” DNS status mean?
No. In this interface, the status reflects whether a usable DNS answer was observed. It is not an HTTP or HTTPS health check and does not confirm that an application is reachable.
Can this tool confirm a subdomain takeover?
No. An alias or stale-looking record can be a lead, but takeover validation requires provider-specific checks, careful evidence, and explicit authorization.
Is subdomain enumeration legal?
Legality depends on jurisdiction, authorization, method, scope, and subsequent conduct. Publicly visible information does not automatically authorize follow-up testing. When in doubt, obtain written permission and professional legal guidance.
How often should an organization review its subdomains?
Review after infrastructure changes and on a schedule suited to the organization's risk. Teams with frequent deployments may need continuous monitoring; smaller estates may use periodic inventory checks plus change-triggered reviews.
Primary references