Images and screens on this page are illustrative. This site does not operate a hosted platform, app or API.
Examples of the screens that commercial subdomain discovery and monitoring tools typically provide: scanners, monitoring dashboards, takeover alerts and API documentation. SubDoms does not offer these features; they are described here for reference only.
The main scanning interface allows you to enter any domain and select which data sources to query. Results appear in real-time as the tool discovers subdomains, with each result enriched with DNS record type, resolved IP address, HTTP status code, and vulnerability indicators. The interface supports both light and dark themes and is fully responsive for use on mobile devices during field assessments.
The monitoring dashboard provides a real-time overview of all your monitored domains. Each domain card shows the total subdomain count, last scan timestamp, change delta since the previous scan, and any active alerts. The timeline view lets you drill into the history of changes for any domain, making it easy to correlate subdomain additions with deployment events or unauthorized access.
When a monitoring tool detects a subdomain vulnerable to takeover, it generates a detailed alert with the affected subdomain, the dangling CNAME or A record, the cloud provider fingerprint match, and step-by-step remediation instructions. Alerts are color-coded by severity and can be integrated with your incident response workflow via Slack, email, or webhook notifications.
Export your scan results in CSV, JSON, or PDF format. The export view lets you filter results by record type, status, source, or vulnerability flag before downloading. Some tools can also export directly to SIEM platforms. The PDF report includes an executive summary, risk heat map, and detailed findings suitable for presenting to management or compliance auditors.
A typical tool's interactive API documentation is built on the OpenAPI specification and provides try-it-now functionality for every endpoint. Each endpoint is documented with request parameters, response schemas, error codes, and code examples in Python, Go, JavaScript, and cURL. The documentation also includes rate limiting details, authentication instructions, and best practices for handling pagination in large result sets.
For power users who prefer the command line, a CLI tool provides the same scanning capabilities in a terminal-friendly format. The output uses color-coded formatting to highlight vulnerabilities and supports pipe-friendly plain text mode for integration with other Unix tools.
The topology view renders your subdomain infrastructure as an interactive graph, showing the relationships between subdomains, CNAME chains, IP addresses, and cloud providers. Nodes are colored by status and can be clicked for detailed information. This visualization is especially useful for understanding complex multi-cloud architectures and identifying concentration risks.
Configure how and when you receive alerts about subdomain changes. Choose from email digests, real-time Slack messages, Microsoft Teams cards, or custom webhook payloads. You can set severity thresholds, quiet hours, and escalation rules to ensure critical alerts reach the right people without overwhelming your team with noise from routine changes.
Each monitored domain receives a security score from 0 to 100 based on subdomain hygiene, takeover risk, certificate health, and DNS configuration best practices. The score trends over time so you can track improvement and demonstrate progress to stakeholders. Drill-down panels explain exactly which factors contribute to or detract from your score.