Subdomain Discovery
Find a domain’s subdomains from public data sources, then see which hosts are live.
What is Subdomain Discovery?
Subdomain Discovery builds an inventory of the hostnames that exist under a registered domain by combining public, read-only data sources. It then deduplicates and filters the results down to true subdomains of your domain.
Because subdomains belong to the registered domain as a whole, this is a domain-level check: the path of the URL you enter does not matter, only the domain. Each discovered host is then validated with a DNS lookup and a single HTTP(S) request so you can see which subdomains are actually live versus merely historical.
How to Use the Tool
- Enter a domain name or URL and click Discover Subdomains.
- Read the Summary tab for total and live host counts.
- Open the Hosts tab to browse every subdomain with its DNS and liveness status.
- Check Findings for notes such as dead hosts or wildcard DNS, then export from Raw.
How the Tool Works
When you submit a domain, we resolve it to its registered base (eTLD+1) and query several public data sources in parallel. Because the underlying data is already public, this surfaces subdomains without any intrusive scanning of the target.
The combined candidates are lowercased, deduplicated, stripped of wildcards, and filtered so only genuine subdomains of your domain remain. Sources that are temporarily rate-limited are skipped gracefully, so your results are never blocked by a single provider being unavailable.
Each surviving host is then validated: we perform a DNS A/AAAA lookup and, when it resolves, a single HTTPS then HTTP HEAD request to check liveness and capture the server header. We also probe for wildcard DNS so you can interpret resolved-but-unreachable hosts correctly. The result is a clear, deduplicated host inventory with live/dead status.
Key Features
- Multi-source aggregation — Multiple public data sources combined in a single pass.
- Passive and non-intrusive — No wordlist brute force and no port scanning.
- Live validation — DNS resolution and an HTTP(S) liveness probe per host.
- Wildcard detection — Flags wildcard DNS so results are easy to interpret.
- Raw JSON — The complete host inventory for scripting and monitoring.
Common Use Cases
- Security teams — Map your external attack surface and spot forgotten subdomains.
- Asset management — Keep an up-to-date inventory of what your domain exposes.
- Takeover review — Find stale hosts pointing at decommissioned services.
- SEO and migrations — Confirm which subdomains are live before and after a move.
Frequently Asked Questions
What is subdomain discovery?
Subdomain discovery is the process of finding the hostnames that exist under a registered domain — for example blog.example.com, api.example.com, or mail.example.com. Knowing your full list of subdomains matters because each one is a potential entry point: forgotten or misconfigured subdomains are a common source of security exposure and takeover risk. This tool builds that inventory for the domain you enter.
Is this active scanning or passive discovery?
It is passive discovery. Rather than brute-forcing hostnames with a wordlist or scanning ports, it queries public data sources that already know which subdomains exist. It then does a lightweight validation step: a DNS lookup and a single HTTP(S) HEAD request per host to see what is actually live. No intrusive scanning is performed.
Where do the results come from?
Results are aggregated from several free, read-only public data sources. Because the underlying data is already public, this reveals subdomains without touching the target beyond a normal web request. If one source is rate-limited or unavailable, the tool continues with the others, so a single outage never blocks your results.
Why do some discovered hosts show as not live?
A hostname can appear in historical records yet no longer resolve or serve content — for example a decommissioned service. The tool marks these as discovered but not live. They are still worth reviewing: stale DNS records and abandoned subdomains are exactly the kind of leftover surface that leads to subdomain takeover, so retiring them is good hygiene.
Will this find every subdomain?
No passive tool can guarantee a complete list. Subdomains that never appeared in any public data source — such as internal-only names — will not show up. What you get is a strong, fast inventory of the publicly observable subdomains, which is usually the most relevant set for security review, asset management, and SEO. For exhaustive coverage, combine passive discovery with your own DNS zone data.