Free Subdomain Discovery Scanner & Enumeration Tool

Subdomain enumeration is the process of discovering subdomains associated with a root domain (e.g., finding mail.example.com, api.example.com under example.com). It is a standard security assessment technique used to map an organization's attack surface and identify potentially vulnerable assets.

Forgotten subdomains can expose development environments, staging servers, internal tools, and legacy applications. Attackers routinely scan for subdomains to find unpatched services and misconfigured DNS records (like dangling CNAMEs) that enable subdomain takeover attacks.

A dangling CNAME occurs when a subdomain has a CNAME record pointing to a service (like a cloud provider, CDN, or SaaS platform) that is no longer active. Attackers can claim the abandoned service and serve malicious content on your subdomain. This is known as a subdomain takeover.

We check 50+ common prefixes including www, mail, ftp, api, cdn, dev, staging, test, admin, portal, vpn, remote, webmail, autodiscover, and many more. These cover the most commonly used subdomain patterns across organizations of all sizes.

Querying public DNS records is legal and is done billions of times daily by DNS resolvers worldwide. Our tool performs standard DNS lookups on common subdomain prefixes. However, you should only scan domains that you own or have explicit authorization to test.

Regularly audit your subdomains and remove DNS records pointing to decommissioned services. Monitor for dangling CNAMEs, use wildcard DNS carefully, and implement a process for cleaning up DNS when deprovisioning cloud resources. Vysiro provides continuous subdomain monitoring on paid plans.