What is a subdomain?

A subdomain is a name under a domain, such as mail.example.com, api.example.com, or dev.example.com under example.com. Each one can point to its own server through its own DNS records, so organizations use subdomains to split up their websites, mail servers, APIs, test environments, and internal tools. DNS has no way to list every name under a domain, so subdomains have to be found by asking for names one by one and by reading the records that mention them.

Tool description

The Subdomain Finder looks for subdomains of a domain using DNS records only. Enter a domain, and the tool reads the domain's own records for names that point back into it, then checks a list of 350 common subdomain names such as www, mail, api, dev, and staging. Every subdomain it finds is shown in a table with its IPv4 and IPv6 addresses, its CNAME target, and the record it was found through.

Features

  • Finds subdomains named in the domain's NS, MX, SOA, SRV, and SPF records, such as name servers, mail servers, and _spf include records
  • Checks 350 common subdomain names and keeps the ones that have an IPv4 or IPv6 address
  • Follows CNAME records one step: a CNAME target inside the domain is added as a subdomain too
  • Keeps checking common names when the domain has a wildcard DNS record, and lists the ones whose records differ from the wildcard's
  • Shows each subdomain's IP addresses, CNAME target, and source in a table you can sort and export as CSV or JSON
  • A URL or www. address is reduced to the domain, so https://www.example.com/page searches example.com
  • Subdomains of subdomains can be searched too: enter dev.example.com to look for names under it

Where the subdomains come from

  • Common name: the name is on the tool's list and has an A or AAAA record. Under a wildcard, it's listed when its records differ from the wildcard's.
  • NS record: the domain's name servers are hosted under the domain, like ns1.example.com.
  • MX record: the domain's mail servers, like mail.example.com.
  • SOA record: the primary name server named in the domain's SOA record.
  • SRV record: the target of a common service record, such as _autodiscover._tcp, _sip._tcp, _xmpp-server._tcp, or _imaps._tcp.
  • SPF record: a name used by an include:, a:, mx:, ptr:, exists:, or redirect= term in the domain's SPF record.
  • CNAME record: the CNAME target of another subdomain that was found.

Names from records are listed even when they have no IP address, since the record shows they are in use. For example, SPF include names like _spf.example.com usually only hold a TXT record.

Domains with a wildcard record

A wildcard record such as *.example.com answers for every name under the domain that has no records of its own, so every common name resolves and looking them up alone proves nothing. The tool looks up three random names first to learn what the wildcard answers, then checks each common name's A, CNAME, AAAA, TXT, and MX records and compares them with the wildcard's. A wildcard never applies to a name that has records of its own, so a name is listed when its answers differ, for example:

  • it points to other addresses, or has a CNAME to a different target
  • it has a TXT or MX record the wildcard doesn't have, or an AAAA record the wildcard lacks
  • it has no A record where the wildcard has one, as with a name that only holds an MX record

A name whose records match the wildcard's exactly, like an A record with the same address and nothing else, can't be told apart from it and isn't listed. When the wildcard answers with a different address on every lookup, as load-balanced platforms do, addresses can't be compared, so only whether each record type exists is checked. Lookups that fail or time out are never counted as a difference.

Safety and limits

  • Only DNS queries are made, and they go to Google Public DNS. The tool never connects to the subdomains it finds.
  • Only public domain names on a real top-level domain are accepted. IP addresses, localhost, and internal names such as .local or .corp are rejected.
  • Zone transfers (AXFR) are not attempted, so subdomains that are not in the records above and not on the list of common names are not found.
  • The whole search has 3.5 seconds. If it runs out of time, the subdomains found so far are shown with a warning that the list may be incomplete.
  • Up to 100 names from records and 10 IP addresses per subdomain are shown.
  • Some DNS providers answer "no data" instead of "no such name" for names that don't exist, so a common name only counts as found when it has an address.