What is an online subdomain finder?

An online subdomain finder discovers hostnames beneath a root domain using certificate transparency logs, passive OSINT sources, and DNS resolution — accessible from a web browser without installing Subfinder, Amass, or other CLI tools. ScanSuite's free tier uses crt.sh for Certificate Transparency search, Subfinder for passive source aggregation, and DNS resolution for A, AAAA, and CNAME records. Results include discovered subdomain names, resolution status, IP addresses, and the sources that surfaced each hostname.

How does the ScanSuite subdomain finder work?

Enter a root domain and click Scan. ScanSuite validates the domain, queries crt.sh for TLS certificates listing subdomains in Subject Alternative Name fields, runs Subfinder to aggregate passive sources like DNS archives and search engines, merges and deduplicates findings, then resolves DNS records for each unique hostname. Discovery events stream to your browser in real time. The completed report shows discovered, resolved, and active HTTP counts with a detailed subdomain table and shareable 24-hour public URL.

What is certificate transparency and crt.sh?

Certificate Transparency (CT) is a public logging system where certificate authorities publish every TLS certificate they issue. The crt.sh service searches these logs, revealing subdomains listed in certificate SAN fields — often including staging, internal, and forgotten hostnames. CT search is passive: it queries public logs rather than sending traffic to the target's DNS or web servers. This makes crt.sh one of the most effective passive subdomain discovery sources available on ScanSuite's free tier.

What is Subfinder and how is it used here?

Subfinder is an open-source passive subdomain discovery tool that queries dozens of public sources including DNS history databases, search engines, threat intelligence feeds, and code repositories. On ScanSuite's free tier, Subfinder runs in passive mode only — aggregating publicly available subdomain hints without active wordlist brute forcing. Results merge with crt.sh findings and undergo DNS resolution to confirm which hostnames currently resolve.

Does the free subdomain finder use brute force?

No. The free PUBLIC_FREE policy explicitly disables brute force enumeration, permutations, HTTP probing, port scanning, and takeover detection. Free discovery relies exclusively on passive sources (crt.sh and Subfinder) plus DNS resolution. Brute force wordlist scanning and permutation engines are Premium features requiring an authenticated ScanSuite subscription.

Does the free tool detect subdomain takeover?

No. Subdomain takeover detection analyzes dangling CNAME records pointing to deprovisioned cloud resources (S3 buckets, Azure endpoints, GitHub Pages, etc.). This requires Premium ScanSuite. The free tier maps discovered hostnames and DNS records but does not assess takeover risk. For dedicated takeover scanning, see our Premium subdomain takeover tool at /scan/subdomain-takeover.

How many subdomains can the free tier find?

The free tier returns up to 50 discovered subdomains per scan, enforced by the PUBLIC_FREE max_results policy. This cap covers the majority of passive discovery results for typical corporate domains. Premium removes the limit and enables continuous monitoring with change alerts when new subdomains appear in future scans.

Is subdomain enumeration legal?

Passive subdomain discovery on domains you own or have written authorization to assess is standard security practice aligned with bug bounty programs, penetration testing contracts, and internal asset management. Enumerating third-party domains without permission may violate computer misuse laws, bug bounty scope rules, and terms of service. ScanSuite requires Terms of Service acceptance before scanning. Always verify scope and obtain authorization.

What DNS records does the free tier resolve?

The free tier resolves A (IPv4), AAAA (IPv6), and CNAME records for each discovered subdomain. Resolution confirms whether a hostname currently points to live infrastructure. MX and TXT records are not included in the free subdomain report — use our DNS lookup tool for comprehensive record queries on specific hostnames.

Why do some subdomains show as unresolved?

A subdomain may appear in certificate transparency logs or passive sources but lack current DNS records. Common causes include decommissioned services whose certificates remain in CT archives, internal-only hostnames never published to public DNS, typos in certificate SAN fields, and wildcard certificate entries. Unresolved status does not mean the name is safe to ignore — it may indicate stale infrastructure requiring DNS cleanup.

What does completed_with_warnings mean?

A completed_with_warnings report indicates the scan finished but one or more discovery sources failed or timed out. Partial results are still returned — review the warnings banner on the report page for details about which sources encountered errors. Common causes include upstream API rate limits on crt.sh or Subfinder provider timeouts. Retry later or upgrade to Premium for redundant source coverage.

Is this subdomain finder free?

Yes. ScanSuite's free subdomain finder requires no signup. It performs passive discovery via crt.sh and Subfinder with DNS resolution, streaming results in real time and producing a shareable 24-hour report. Free tier limits: 50 results per scan, 8 scans per day, 3 scans per hour. Premium adds brute force, permutations, HTTP probing, port scanning, takeover detection, unlimited results, and permanent private reports.

How is ScanSuite different from running Subfinder locally?

Local Subfinder requires installation, API key configuration for some providers, and manual merging of results with DNS resolution tools. ScanSuite runs the full pipeline server-side — crt.sh query, Subfinder aggregation, deduplication, DNS resolution, and structured reporting — from cloud infrastructure with a shareable web report. Local tools offer more customization and scripting; ScanSuite offers zero-install convenience and team-friendly report URLs.

Can I share subdomain scan results?

Free scans generate a public report URL immediately upon completion, accessible to anyone with the link for 24 hours. Reports include the subdomain table, discovery counts, source attribution, and warnings if applicable. Premium subscribers store encrypted private reports permanently with export options. Avoid sharing reports containing sensitive internal naming conventions if your policy restricts such disclosure.

Should I scan my own domain?

Yes — mapping subdomains on domains you own is a security best practice recommended by OWASP, NIST, and attack surface management frameworks. Shadow IT, forgotten staging environments, and orphaned DNS records frequently surface only through external enumeration. Schedule regular passive scans after infrastructure changes, acquisitions, and certificate renewals to maintain accurate external asset inventory.

How does subdomain discovery relate to MITRE ATT&CK?

MITRE ATT&CK technique T1590.002 (Gather Victim Network Information: DNS) and T1590.001 (Domain Properties) describe adversary reconnaissance that includes subdomain enumeration. Defenders use the same techniques during authorized assessments to identify exposure before attackers. ScanSuite supports defensive reconnaissance with documented reports suitable for remediation tracking and compliance evidence.

Can I probe HTTP services on discovered subdomains?

HTTP probing — checking whether subdomains serve live web content and capturing status codes — requires Premium ScanSuite. The free tier reports active_http_count as zero because HTTP probing is disabled in the PUBLIC_FREE policy. After passive discovery, manually visit resolved subdomains or upgrade to Premium for automated HTTP service detection across all discovered hostnames.

What rate limits apply to free subdomain scans?

The free tier allows 8 subdomain scans per day and 3 per hour per client IP address. Individual domains are capped at 20 scans per day to prevent abuse. If you exceed limits, wait for the rolling window to reset or upgrade to Premium for higher quotas and scheduled scanning.

Subdomain Finder — Free Online Subdomain Discovery

A subdomain finder discovers hostnames beneath a root domain by querying certificate transparency logs, passive DNS and OSINT sources, and resolving DNS records — revealing external attack surface without active brute force when using passive enumeration methods.

Enter a root domain (e.g., example.com) and click Scan. ScanSuite queries crt.sh for certificate transparency entries, runs Subfinder passive enumeration, merges results, and resolves A, AAAA, and CNAME records. The free tier discovers up to 50 subdomains using passive sources only — no brute force, HTTP probing, or takeover detection.

Subdomain enumeration maps the hostnames associated with a root domain — revealing web applications, staging environments, mail servers, CDNs, and forgotten services that expand an organization's attack surface. Security teams, penetration testers, and asset owners use subdomain discovery to find shadow IT, validate DNS hygiene, and prioritize external exposure before adversaries do.

ScanSuite's free subdomain finder combines certificate transparency search (crt.sh), Subfinder passive source aggregation, and DNS resolution in a browser-based workflow. The free PUBLIC_FREE policy uses passive discovery only — no wordlist brute force, permutations, HTTP probing, or subdomain takeover checks. Premium ScanSuite unlocks active enumeration, live web service detection, port scanning on discovered hosts, takeover risk assessment, and continuous monitoring.

ScanSuite's free subdomain finder discovers hostnames via certificate transparency (crt.sh), Subfinder passive enumeration, and DNS resolution — up to 50 results with no signup. Premium unlocks brute force, permutations, HTTP probing, takeover detection, and continuous monitoring for comprehensive attack surface management.

Frequently Asked Questions

What is an online subdomain finder?: An online subdomain finder discovers hostnames beneath a root domain using certificate transparency logs, passive OSINT sources, and DNS resolution — accessible from a web browser without installing Subfinder, Amass, or other CLI tools. ScanSuite's free tier uses crt.sh for Certificate Transparency search, Subfinder for passive source aggregation, and DNS resolution for A, AAAA, and CNAME records. Results include discovered subdomain names, resolution status, IP addresses, and the sources that surfaced each hostname.
How does the ScanSuite subdomain finder work?: Enter a root domain and click Scan. ScanSuite validates the domain, queries crt.sh for TLS certificates listing subdomains in Subject Alternative Name fields, runs Subfinder to aggregate passive sources like DNS archives and search engines, merges and deduplicates findings, then resolves DNS records for each unique hostname. Discovery events stream to your browser in real time. The completed report shows discovered, resolved, and active HTTP counts with a detailed subdomain table and shareable 24-hour public URL.
What is certificate transparency and crt.sh?: Certificate Transparency (CT) is a public logging system where certificate authorities publish every TLS certificate they issue. The crt.sh service searches these logs, revealing subdomains listed in certificate SAN fields — often including staging, internal, and forgotten hostnames. CT search is passive: it queries public logs rather than sending traffic to the target's DNS or web servers. This makes crt.sh one of the most effective passive subdomain discovery sources available on ScanSuite's free tier.
What is Subfinder and how is it used here?: Subfinder is an open-source passive subdomain discovery tool that queries dozens of public sources including DNS history databases, search engines, threat intelligence feeds, and code repositories. On ScanSuite's free tier, Subfinder runs in passive mode only — aggregating publicly available subdomain hints without active wordlist brute forcing. Results merge with crt.sh findings and undergo DNS resolution to confirm which hostnames currently resolve.
Does the free subdomain finder use brute force?: No. The free PUBLIC_FREE policy explicitly disables brute force enumeration, permutations, HTTP probing, port scanning, and takeover detection. Free discovery relies exclusively on passive sources (crt.sh and Subfinder) plus DNS resolution. Brute force wordlist scanning and permutation engines are Premium features requiring an authenticated ScanSuite subscription.
Does the free tool detect subdomain takeover?: No. Subdomain takeover detection analyzes dangling CNAME records pointing to deprovisioned cloud resources (S3 buckets, Azure endpoints, GitHub Pages, etc.). This requires Premium ScanSuite. The free tier maps discovered hostnames and DNS records but does not assess takeover risk. For dedicated takeover scanning, see our Premium subdomain takeover tool at /scan/subdomain-takeover.