Reconnaissance · Tool 11
Subdomain Checker
List a domain's public subdomains and find DNS records left pointing at nothing.
A subdomain checker finds the hostnames that exist under a domain, such as mail., shop. or staging., from public DNS records and the certificates issued for them. Use it before a migration to see which subdomains need to come across, or to see what a domain exposes. This one also looks up each name and flags CNAME records that point at something that no longer exists. Results come from public sources and can lag a change by a day.
How this works - what gets checked, in plain English
- What we query: any domain. We read public Certificate Transparency logs, the public record of certificates issued for a name, then look up each name in DNS.
- What we find: names found in public sources, which often include old staging hosts and vendor portals. It is not a complete list of what a domain runs.
- Why it matters: a CNAME left behind after a service is shut down can let someone else claim the name and publish on your subdomain.
- What we don't do: we don't guess names or brute-force them, and we send no HTTP requests to any subdomain. We only read public logs and make DNS lookups, so we never touch your servers.
How the check works
We read the names from Certificate Transparency logs through crt.sh. If it is slow we show Cert Spotter's list first, then update it when crt.sh answers. HackerTarget's passive DNS data is the last resort. Then we ask DNS about each name: its A, AAAA and CNAME records, following any CNAME chain to where it ends. Every name gets one of these statuses:
- Live
- The name resolves to an address. This does not prove the site behind it is healthy, or that it is still yours.
- No longer resolves
- The name has no address. Usually a host that was retired properly.
- Dangling
- A CNAME is still in place, but the name it points to returned NXDOMAIN or an empty answer, so it leads nowhere. If the target still has other records, such as mail, it exists, and the name shows as No longer resolves.
- Possible takeover
- Dangling, and the missing name sits on a third-party service where names can be registered, such as Azure. It is worth checking, not proof that anyone can claim it.
- Could not check
- The lookup timed out or returned a server error. That tells us nothing about the name, so we do not flag it.
- Not checked
- A scan checks up to 2,000 names and stops after 30 seconds. Anything past that point is listed but not looked up, and the results say so.
To handle wildcard DNS, we also look up a made-up name under the same parent. If it gets the same answer as a real name, that name is marked Wildcard, because the answer proves nothing about that name in particular.
What these sources miss
- Names that never had a public certificate. An internal host, or one covered by a wildcard certificate such as *.example.com, leaves no name in the logs.
- Some released sites. GitHub Pages, Amazon S3 and herokuapp.com answer for every name, so an abandoned site on them shows as Live here. Spotting one means requesting the page, and we do not send HTTP requests.
- Retired names when crt.sh cannot answer. Cert Spotter only lists certificates that have not expired, so old hosts can be missing, and the results say when this has happened.
Questions
What is a dangling DNS record?
A CNAME that still points at a name that no longer exists or has no address. It usually happens when a service is shut down and nobody removes the DNS entry.
What is a subdomain takeover?
If a dangling CNAME points at a service where anyone can register that name, someone else can claim it and publish their own content on your subdomain.
Does Possible takeover mean my domain has been attacked?
No. It means the DNS looks like the pattern that makes a takeover possible. Whether the name can really be claimed depends on the service.
How do I fix a flagged subdomain?
Remove the DNS record if you no longer use the service. If you still need it, reclaim the name on the service so the record points at something you control.
Why do so many of my subdomains no longer resolve?
Certificate logs are permanent, so a host you retired years ago stays in them. A long list of names that no longer resolve is normal.
Why is a subdomain I know about missing?
The list only holds names found in public sources. A subdomain that never had its own public certificate will not appear, even though it works.
Does this tool connect to my servers?
No. It reads public logs and makes DNS lookups. It sends no HTTP requests to any subdomain, so your web servers never see it. Your DNS provider may see the lookups.
Can I share the results?
Yes. Add the domain to the address, as in /subdomains?domain=example.com, and the scan runs when the page opens. Results are cached for up to an hour.
Subdomain Enumeration via Certificate Transparency
What We Just Mapped
We read public Certificate Transparency logs for names under your domain, then looked up each one in DNS to see which still resolve and which point at something that no longer exists. Only names found in public sources appear here.
How GoZen Helps You Lock It Down
Shared and WordPress plans include free SSL through AutoSSL, a server-level web application firewall with malware scanning, and cPanel for managing your subdomains.
Explore GoZen Hosting