Subdomain Discovery - Find Hidden Subdomains
Discover all subdomains for any domain. Uses certificate transparency logs, DNS enumeration, and other techniques to map the complete domain infrastructure.
Understanding This Tool
What It Does
This tool checks a domain you enter against a small fixed set of common subdomains. On the server it tests nine standard prefixes - www, mail, ftp, admin, blog, shop, api, dev, and staging - by attempting a DNS A (IPv4 address) record lookup for each one (for example, www.example.com). It then lists every prefix from that set that returned an A record at the time of the check. It is a quick first-pass test of common subdomain names, not an exhaustive enumeration of every subdomain a domain might have.
Understanding the Results
- Found Subdomains (count): The heading shows how many of the nine tested prefixes returned a DNS A record for your domain. This number reflects only this fixed list, not the total number of subdomains the domain may have.
- Subdomain hostname list: Each item is a full hostname (such as mail.example.com or api.example.com) whose A-record lookup returned a result when the tool ran. A listed subdomain means an A record was found, not that the service behind it is online or reachable.
- No common subdomains found: Shown when you submit a domain but none of the nine tested prefixes return an A record. This does not mean the domain has no subdomains - only that none of these specific common names resolved during the check, or that they use IPv6-only (AAAA) or CNAME records, which this tool does not query.
Common Use Cases
- Quick infrastructure spot-check: See at a glance whether common service names like mail, ftp, or api return an A record for a domain you own or manage.
- Confirming standard subdomains exist: Verify that expected prefixes such as www, blog, or shop are pointing somewhere in DNS via an A record.
- Spotting exposed staging or dev hosts: Check whether dev.example.com or staging.example.com resolve publicly on your own properties, which may be worth reviewing.
- Teaching DNS basics: Demonstrate how subdomain names map to A records and how a name resolving differs from a service actually running.
- Starting point before deeper work: Use the results as a first pass, then move to a full enumeration tool if you need certificate transparency logs, large wordlists, or AAAA and CNAME coverage.
Pro Tips & Best Practices
- Enter the bare domain: Type the registered domain only (example.com), not a full URL or a subdomain - the tool adds the nine prefixes itself.
- Treat it as a sampled check: Only nine fixed prefixes are tested, so an empty result does not mean a domain lacks subdomains - it means these specific names did not return an A record.
- Remember it tests IPv4 A records only: The check queries A (IPv4) records, so subdomains that use only IPv6 (AAAA) or are set up as CNAME aliases without an A record may not appear.
- Resolution is not reachability: A subdomain appearing in the list means it returned an A record when checked, not that the website or service is up, responding, or secure - verify those separately.
Frequently Asked Questions
It does not crawl or brute-force the whole namespace. It takes the domain you enter and attempts a DNS A (IPv4 address) lookup for nine fixed common prefixes: www, mail, ftp, admin, blog, shop, api, dev, and staging. Any of those that return an A record are listed.
The tool only tests those nine common prefixes, so subdomains using other names are never checked. It also queries only A records, so subdomains that resolve only via IPv6 (AAAA) or as CNAME aliases without an A record will not appear, even though they exist. A lookup can also return nothing if it does not complete during the check.
No. This tool checks a small fixed list of nine common prefixes through standard DNS A-record lookups. It does not query certificate transparency logs, use a large wordlist, or attempt zone transfers. For exhaustive discovery, use a dedicated enumeration tool.
No. Appearing in the list means the subdomain returned an A record when the tool ran. The host behind it could be offline, firewalled, or returning errors. Resolution and reachability are separate things you should verify independently.
The tool performs ordinary public DNS lookups, which work for any domain. That said, you should only investigate infrastructure you own or are authorized to assess. Use the results responsibly and within applicable rules and laws.
Frequently Asked Questions
How does this tool find subdomains?
It does not crawl or brute-force the whole namespace. It takes the domain you enter and attempts a DNS A (IPv4 address) lookup for nine fixed common prefixes: www, mail, ftp, admin, blog, shop, api, dev, and staging. Any of those that return an A record are listed.
Why did it find no subdomains for a domain that clearly has some?
The tool only tests those nine common prefixes, so subdomains using other names are never checked. It also queries only A records, so subdomains that resolve only via IPv6 (AAAA) or as CNAME aliases without an A record will not appear, even though they exist. A lookup can also return nothing if it does not complete during the check.
Does this use certificate transparency logs or a large wordlist?
No. This tool checks a small fixed list of nine common prefixes through standard DNS A-record lookups. It does not query certificate transparency logs, use a large wordlist, or attempt zone transfers. For exhaustive discovery, use a dedicated enumeration tool.
Does a listed subdomain mean the site or service is online?
No. Appearing in the list means the subdomain returned an A record when the tool ran. The host behind it could be offline, firewalled, or returning errors. Resolution and reachability are separate things you should verify independently.
Can I check subdomains for any domain, or only ones I own?
The tool performs ordinary public DNS lookups, which work for any domain. That said, you should only investigate infrastructure you own or are authorized to assess. Use the results responsibly and within applicable rules and laws.
Last reviewed:
How this tool works: This tool runs in your browser and on our server in real time. Depending on the tool, results are computed directly from the input you provide or retrieved from live, authoritative data sources at the moment you run a lookup. We do not sell your data, and your lookups are kept private — any history shown here is stored only on your device.