free security tools
← Back to tools

Subdomain Scanner

Quick subdomain discovery via common wordlist + DNS-over-HTTPS. Rate-limited to ~250 req/min by Cloudflare DNS. For full scans, use tools like subfinder or amass locally.

Found subdomains

Enter a domain and click Scan

What is Subdomain Scanner?

Discover subdomains using wordlist-based DNS resolution. Find hidden services, staging environments, and forgotten admin panels.

Security Guide

Subdomain discovery
Find hidden staging/admin/forgotten services via DNS wordlist enumeration
Stale DNS records
Remove records for decommissioned services — stale CNAMEs enable takeover → Takeover Checker
CNAME claims
Claim unclaimed CNAME targets (Heroku/S3/GitHub Pages) before attackers do
Wildcard DNS
Audit *.example.com wildcards — they can expose internal services
DNS monitoring
Monitor for unauthorized CNAME/A record changes indicating compromise