Subdomain Finder
Discover subdomains of any domain using DNS brute-force scanning. Find hidden services, APIs, and infrastructure.
Subdomain Finder Features
Discover the full scope of a domain's infrastructure through DNS scanning.
Fast Parallel Scanning
Checks 80+ common subdomain prefixes in parallel batches for fast results. Each lookup has a 3-second timeout to avoid hanging.
IP Address Mapping
Shows the resolved IP address for each discovered subdomain, helping you map out the infrastructure and identify shared servers.
Security Assessment
Discover forgotten staging servers, admin panels, and dev environments that may be exposed to the public internet.
Searchable Results
Filter discovered subdomains by name or IP address with instant search. Quickly pinpoint what you're looking for.
How It Works
Three steps to discover subdomains for any domain.
Enter Domain
Type the root domain you want to scan. We automatically strip protocols and www prefixes to target the base domain.
DNS Brute-Force
We check 80+ common subdomain prefixes (www, mail, api, admin, dev, etc.) against DNS servers to see which ones resolve.
View Results
Browse all discovered subdomains with their IP addresses. Use the search filter to find specific entries in large result sets.
Related Tools
More tools to investigate domains and web infrastructure.
Frequently Asked Questions
Common questions about subdomain discovery.
What is subdomain enumeration?
Subdomain enumeration is the process of discovering all subdomains belonging to a domain. Subdomains like mail.example.com, api.example.com, or staging.example.com often host different services. Finding them reveals the full scope of an organization's internet-facing infrastructure.
How does DNS brute-force scanning work?
DNS brute-force scanning works by prepending a list of common subdomain prefixes (like www, mail, api, admin, dev) to the target domain and checking if each one resolves to an IP address via DNS. If a DNS query returns a valid IP, that subdomain exists.
Will this find all subdomains?
No tool can guarantee finding every subdomain. This scanner checks 80+ common prefixes which covers the most typical subdomains. Randomly named or highly custom subdomains won't be found through brute-force alone. For exhaustive discovery, certificate transparency logs and other OSINT sources are needed.
Is subdomain scanning legal?
DNS lookups are public queries and performing them is generally legal. However, aggressive scanning can be seen as hostile by some organizations. This tool uses a modest wordlist and standard DNS resolution, making it equivalent to normal DNS queries. Always ensure you have authorization before performing security assessments on domains you don't own.