Everything you need to know about subdomain discovery, our platform, and DNS security. If you do not find your answer here, reach out to our team via the contact page.
Subdomain enumeration is the process of discovering all subdomains associated with a given domain name. It matters because every subdomain represents a potential entry point into your infrastructure. Organizations commonly have hundreds or even thousands of subdomains spread across development environments, staging servers, API endpoints, marketing microsites, and legacy systems. Many of these subdomains are created and then forgotten, yet they remain publicly accessible and may run outdated software or point to decommissioned services. A comprehensive subdomain inventory is the foundation of effective attack surface management, vulnerability assessment, and compliance auditing. Without knowing what subdomains exist, you cannot secure them.
SubDoms uses a multi-source approach that combines passive and active reconnaissance techniques. On the passive side, we query Certificate Transparency logs (which record every publicly issued SSL certificate), historical passive DNS databases maintained by security research organizations, search engine caches, and web archive data. On the active side, we perform intelligent DNS brute-forcing using a curated wordlist of over 200,000 common subdomain names, attempt DNS zone transfers where permitted, and use permutation algorithms to generate and test variations of known subdomains. By combining these methods, we achieve coverage that exceeds what any single tool or technique can provide.
Passive reconnaissance, such as querying Certificate Transparency logs and passive DNS databases, involves only looking up publicly available information and is generally considered legal in most jurisdictions. However, active techniques like DNS brute-forcing send DNS queries to the target domain authoritative name servers, which could be considered unauthorized access under certain laws depending on your jurisdiction and the terms of service of the domain owner. We strongly recommend only performing active scans on domains you own, are authorized to test, or as part of a bug bounty program that explicitly permits subdomain enumeration. SubDoms provides a responsible disclosure policy and we expect all users to comply with applicable laws and our Terms of Service.
A subdomain takeover occurs when a subdomain points to a third-party service (like AWS S3, Heroku, GitHub Pages, or Azure) that has been decommissioned or was never properly configured. An attacker can claim the unclaimed resource on the third-party platform and serve their own content on your subdomain. This can be used for phishing, cookie theft, or reputation damage. SubDoms detects takeover vulnerabilities by checking each discovered subdomain CNAME record against a database of over 80 cloud service fingerprints. When a CNAME points to a service that returns an error page indicating the resource is unclaimed, we flag it as vulnerable and provide step-by-step remediation guidance.
Our platform maintains a 99.7% accuracy rate based on ongoing validation against known domain configurations. Every result from Certificate Transparency logs is verified because CT logs are cryptographically signed and tamper-evident. Passive DNS results are cross-referenced across multiple data providers to reduce false positives. For active DNS brute-forcing, we verify each potential subdomain with authoritative DNS queries and filter out wildcard DNS responses that could generate millions of false hits. We also use machine learning models to identify and suppress results from domains with aggressive wildcard configurations. No tool is perfect, but our multi-source, cross-validated approach delivers the highest accuracy in the industry.
Yes, our Professional and Enterprise plans include continuous monitoring. You can configure automated scans to run at regular intervals from every 6 hours to weekly. When a new subdomain is detected, an existing record changes, or a new SSL certificate is issued for your domain, you receive instant notifications via email, Slack, Microsoft Teams, or a custom webhook URL. The monitoring dashboard provides a complete change history so you can track when subdomains were added or removed and correlate changes with your deployment activity. This is essential for maintaining an accurate asset inventory and detecting shadow IT or unauthorized infrastructure changes.
Free tier users can export results as CSV. Professional users get CSV, JSON, and PDF export options. Enterprise users additionally get XML export and direct integration with SIEM platforms including Splunk, IBM QRadar, and Elastic Security. All export formats include the full result set with subdomain name, DNS record type, resolved value, HTTP status code, technology fingerprint, vulnerability flags, and the data source where each subdomain was found. The API also returns JSON responses that can be programmatically processed and fed into any downstream system.
Our RESTful API provides programmatic access to all SubDoms features. Authentication is handled via API keys that you generate from your account dashboard. The primary endpoint accepts a domain name and returns a list of discovered subdomains with enrichment data. You can also use the API to manage monitoring configurations, retrieve historical scan results, and query our subdomain database directly. Rate limits are generous: Professional plans get 5,000 requests per day, and Enterprise plans get unlimited access. We provide official client libraries for Python, Go, JavaScript, and Ruby, along with comprehensive API documentation, a Postman collection, and OpenAPI specification. The API supports both synchronous and asynchronous scan modes for large domains that take longer to enumerate.
Certificate Transparency (CT) is a framework established by Google that requires all publicly trusted Certificate Authorities to log every SSL/TLS certificate they issue in publicly auditable append-only logs. Because most organizations obtain certificates for their subdomains, CT logs serve as an incredibly rich data source for subdomain discovery. By querying CT logs, we can find subdomains that may not be linked from any website, indexed by search engines, or present in DNS brute-force wordlists. This includes internal-facing subdomains like staging.internal.example.com or api-dev.example.com that organizations might assume are private. CT log monitoring is also valuable for detecting unauthorized certificate issuance, which could indicate a man-in-the-middle attack or domain compromise.
We take data privacy seriously. Scan results for authenticated users are stored in your private account and are never shared with other users or made public. For unauthenticated free scans, results are cached for 24 hours to improve performance and then deleted. We do not sell scan data to third parties. Our infrastructure is hosted in SOC 2 Type II certified data centers with encryption at rest and in transit. For Enterprise customers, we offer data residency options in the US, EU, and Asia-Pacific regions. You can delete your account and all associated data at any time. See our Privacy Policy for full details.
Open-source tools like Sublist3r, Amass, and Subfinder are excellent and we use some of their techniques ourselves. However, SubDoms differs in several key ways. First, we maintain a continuously updated index of over 2.4 billion subdomains, which means lookups against our database return results in milliseconds without requiring a live scan. Second, we provide enrichment data (IP, HTTP status, technology stack, vulnerability flags) that standalone enumeration tools do not include. Third, we offer continuous monitoring with alerting, which is not a feature of one-shot scanning tools. Fourth, our web-based interface and API make it accessible to team members who may not be comfortable running command-line tools. Finally, we handle wildcard DNS detection, rate limiting, and false positive filtering automatically, which requires significant manual effort with standalone tools.
Yes. Our free tier includes 10 scans per day using Certificate Transparency and Passive DNS data sources, basic takeover detection, and CSV export. No credit card is required. The free tier is designed for individual researchers, students, and small projects. For higher scan volumes, additional data sources, continuous monitoring, and API access, check out our Professional and Enterprise plans.