From free subdomain lookups to enterprise-grade attack surface monitoring, SubDoms provides the tools and expertise security teams need to maintain complete visibility over their DNS infrastructure.
Our core service provides on-demand subdomain enumeration for any domain. We combine data from Certificate Transparency logs, passive DNS databases, dictionary brute-forcing, and web scraping to deliver the most comprehensive results available. Each scan queries over 47 independent data sources and cross-references results to eliminate false positives. The output includes DNS record types, IP resolutions, HTTP status codes, and technology fingerprints for every discovered subdomain. Scans typically complete in under 30 seconds for domains with fewer than 500 subdomains. Results can be exported as CSV, JSON, or integrated directly into your SIEM via our API.
Set up automated monitoring for domains you own or are responsible for securing. Our monitoring service performs scheduled scans at intervals you define, from every six hours to weekly. When new subdomains appear, DNS records change, or SSL certificates are issued for your domain, you receive instant notifications via email, Slack, Microsoft Teams, or webhook. The monitoring dashboard provides a historical timeline of all changes, making it easy to track infrastructure drift and identify unauthorized additions. This service is essential for organizations that need to maintain an accurate and up-to-date asset inventory for compliance and security auditing purposes.
Subdomain takeover is one of the most common and dangerous web vulnerabilities. It occurs when a subdomain points to a third-party service that has been decommissioned or was never properly claimed. Our takeover detection service continuously checks your subdomains against a database of over 80 cloud service fingerprints, including AWS S3, Azure, Heroku, GitHub Pages, Netlify, Shopify, and many more. When a dangling CNAME or orphaned A record is detected, we verify the vulnerability and alert your team with detailed remediation instructions. We also provide bulk scanning for organizations managing thousands of subdomains across multiple domains.
Integrate SubDoms intelligence directly into your security toolchain. Our RESTful API provides programmatic access to all platform features, including subdomain lookups, bulk scanning, monitoring management, and historical data queries. The API supports JSON responses, pagination, rate limiting with generous quotas, and authentication via API keys. Use it to automate asset discovery in your CI/CD pipeline, enrich threat intelligence feeds with subdomain data, or build custom dashboards. We provide client libraries for Python, Go, JavaScript, and Ruby, along with comprehensive API documentation and Postman collections to get you started quickly.
Flexible plans for individuals, teams, and enterprises
For individual researchers and students
For security professionals and small teams
For security teams and large organizations
Beyond our automated platform, our team of experienced security professionals offers hands-on subdomain security audits. Our auditors manually review your DNS infrastructure, identify misconfigurations, test for subdomain takeover vulnerabilities, assess SSL/TLS certificate hygiene, and provide a detailed report with prioritized remediation steps. Each audit includes a 60-minute debrief call with your team and three months of follow-up monitoring to verify fixes. Custom audits are ideal for organizations preparing for compliance certifications, responding to incidents, or conducting due diligence during mergers and acquisitions. Contact us for scoping and pricing.
Request a Quote