Professional-grade subdomain discovery and DNS security tools for penetration testers, bug bounty hunters, and security analysts. Enumerate subdomains, analyze DNS records, detect potential subdomain takeover vulnerabilities, and audit security headers. All tools use real-time DNS queries against public resolvers.
Discover subdomains for any domain using DNS brute-force enumeration against a curated wordlist of the most common subdomain names. This tool tests over 50 popular subdomain prefixes including www, mail, ftp, dev, staging, api, admin, and more. Subdomain enumeration is a critical reconnaissance phase in penetration testing and bug bounty hunting. Hidden subdomains often run outdated software, expose internal services, or contain development environments with weaker security controls. Identifying your complete attack surface is the first step in any security assessment.
Perform a comprehensive DNS lookup for any domain or subdomain. This tool queries all major record types (A, AAAA, CNAME, MX, NS, TXT, SOA) and presents the results in a structured format. DNS records reveal critical information about a domain's infrastructure, email configuration, CDN usage, and security posture. Security professionals use DNS analysis to map infrastructure, identify hosting providers, discover mail servers for social engineering assessments, and verify security records like SPF, DKIM, and DMARC that protect against email spoofing.
Check subdomains for potential takeover vulnerabilities. A subdomain takeover occurs when a subdomain points to an external service (like GitHub Pages, AWS S3, Heroku, or Azure) that has been decommissioned but the DNS record remains. An attacker can register the same resource on the external service and serve malicious content on your subdomain. This is one of the most common vulnerabilities found in bug bounty programs, and it can lead to cookie theft, phishing, and reputation damage. This tool checks CNAME records and verifies if the target services are still active.
Analyze the security-related HTTP response headers of any website. Security headers are critical defense mechanisms that instruct browsers to apply security policies when loading a page. Missing headers leave websites vulnerable to clickjacking, cross-site scripting (XSS), MIME-type confusion attacks, and other client-side exploits. This tool checks for all OWASP-recommended security headers including Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and Permissions-Policy, providing a grade and actionable recommendations for each finding.
Retrieve WHOIS registration data for any domain using RDAP (Registration Data Access Protocol). WHOIS data reveals domain ownership, registration dates, nameserver configuration, and registrar information. During security assessments, WHOIS data helps identify related domains owned by the same organization, determine domain age for trust assessment, and find technical contacts for responsible disclosure. The transition from traditional WHOIS to RDAP provides structured, machine-readable data with better privacy controls mandated by GDPR and other regulations.
Attack surface management (ASM) is the continuous process of discovering, classifying, and monitoring all internet-facing assets associated with an organization. Subdomains represent a significant portion of most organizations' attack surface, yet they are frequently overlooked in security programs. Research consistently shows that large organizations have hundreds to thousands of subdomains, with many pointing to forgotten development environments, legacy applications, and third-party services that no longer exist. The tools on this page address the core ASM workflow: discovery through DNS enumeration, analysis through record inspection, and risk assessment through takeover detection and header analysis. For organizations serious about reducing their attack surface, these tools should be used regularly as part of an ongoing monitoring program. Combining automated subdomain discovery with manual review of each finding's security posture provides the most comprehensive coverage. Remember that subdomain enumeration via DNS brute-forcing only discovers subdomains that resolve -- additional techniques like certificate transparency log analysis, web crawling, and passive DNS databases can reveal additional assets.