SMTPDoctorDNS & SECURITY
What Is a Subdomain Scanner and How to Use One
7 min read
Most domains are far bigger than the single website you see. Behind example.com there's often mail.example.com, blog.example.com, app.example.com, staging servers, admin panels, and more — each one a subdomain. A subdomain scanner finds them all. This guide explains what that means, why it matters, and how to scan any domain.
What is a subdomain?
A subdomain is a prefix on your main domain that points to a separate service or section. In mail.example.com, the mailpart is the subdomain. Each one has its own DNS records and can host a completely different application, on a different server, than the main site. Organizations accumulate dozens of them over time — and that's where the risk lives.
What is a subdomain scanner?
A subdomain scanner enumerates the subdomains that exist under a domain by querying DNS and public data sources. Instead of guessing hostnames one at a time, it surfaces the full list in one pass. You can run any domain through our subdomain scanner to see what's published under it.
Why finding subdomains matters
Every subdomain is a door into your infrastructure, and the forgotten ones are the most dangerous:
- Attack surface.Each subdomain is another service that can be attacked. You can't secure what you don't know exists.
- Forgotten services. Old staging sites, dev environments, and unused apps often run outdated, vulnerable software.
- Subdomain takeover. If a subdomain's CNAME recordpoints to a third-party service that's been deleted, an attacker can claim that service and serve content from your domain. Scanning finds these dangling records.
- Email and security posture. Mail subdomains and their records affect deliverability and trust across the whole domain.
How to scan a domain's subdomains
The passive approach — used by our tool — queries DNS and public sources to list known subdomains without probing the target's servers. To do it:
- Enter the root domain (like
example.com) into a subdomain scanner. - Review the discovered subdomains and note any you don't recognize.
- For each unfamiliar one, check where it points and whether it's still in use — a CNAME lookup and an SSL check quickly reveal whether a subdomain is live, misconfigured, or dangling.
- Decommission anything unused, and secure anything that should stay.
Scan a domain's subdomains now
Discover the subdomains published under any domain, free and instantly — no signup required.
Open the tool →A note on responsible use
Discovering subdomains through public DNS is passive and fine — that data is already published. But only actively test or probe systems you own or have explicit permission to assess. Use this for securing your own domains and for authorized security work.
Frequently asked questions
What is a subdomain scanner?
A tool that discovers the subdomains under a domain — like mail.example.com — by querying DNS and public sources. It's used for security audits, asset inventory, and finding forgotten services.
Why does finding subdomains matter?
Every subdomain is a potential entry point. Forgotten ones often run outdated software or are vulnerable to takeover. Mapping them all is a basic step in understanding and securing your attack surface.
What is subdomain takeover?
It happens when a subdomain points via CNAME to an external service that's been deleted, letting an attacker claim it and serve content from your domain. Scanning and checking where subdomains point catches this early.