Free Subdomain Finder
Enter any root domain to discover its subdomains. This tool checks common subdomain names using DNS A record lookups to find active subdomains and their IP addresses.
What Are Subdomains?
A subdomain is a subdivision of a domain name in the Domain Name System (DNS) hierarchy. It appears as a prefix before the main domain, separated by a dot -- for example, blog.example.com or api.example.com. Subdomains allow organizations to structure different services, departments, or applications under a single root domain without needing to register additional domain names.
Common uses include hosting a blog (blog.), running a web application (app.), exposing an API (api.), or separating staging and production environments (staging., dev.). Each subdomain can point to a completely different server or IP address through its own DNS records.
Why Discover Subdomains?
Subdomain discovery is a valuable practice for several reasons:
- Security auditing: Knowing all active subdomains helps identify forgotten or abandoned services that might be vulnerable. Shadow IT and legacy applications running on old subdomains can become attack vectors if left unpatched.
- Asset inventory: Organizations often lose track of subdomains over time as teams create new services. Regular enumeration ensures a complete picture of your domain's footprint.
- Competitive research: Understanding a competitor's subdomain structure can reveal the technologies and services they use, from CDN providers to development workflows.
- Migration planning: Before migrating DNS providers or restructuring your domain, a full subdomain inventory ensures nothing gets left behind.
How Subdomain Enumeration Works
This tool uses dictionary-based DNS enumeration, one of the most common and effective techniques. It works by taking a curated wordlist of common subdomain names (like www, mail, api, admin, etc.) and performing DNS A record lookups for each candidate against the target domain.
For each candidate subdomain, the tool constructs the full hostname (e.g., api.example.com) and queries DNS servers to resolve it to an IP address. If the query returns a valid A record, the subdomain exists and is active. The lookups run in parallel with a concurrency limit to balance speed and reliability.
Other enumeration techniques include certificate transparency log scanning, search engine dorking, and zone transfer attempts -- though zone transfers are rarely permitted on properly configured servers. You can verify the DNS configuration of any discovered subdomain using our DNS Lookup tool or check its CNAME records to understand how it's routed.
Subdomains and Custom Domain Setups
Subdomains play a central role in SaaS platforms that support custom domains. A typical pattern is multi-tenant subdomains where each customer gets their own subdomain (e.g., acme.yourapp.com, globex.yourapp.com). This allows SaaS platforms to provide branded, isolated experiences for each tenant.
When a SaaS customer wants to use their own custom domain instead, they typically create a CNAME record pointing their subdomain (like app.acme.com) to the platform's hostname. The platform then needs to verify DNS ownership, provision an SSL certificate, and route incoming requests to the correct tenant.
Building this infrastructure from scratch involves handling DNS verification, certificate automation (via Let's Encrypt or similar CAs), subdomain routing, and DNS provider edge cases. SaaSKevin automates this workflow, letting you offer custom domains to your users without building and maintaining the underlying infrastructure.
Frequently Asked Questions
- What is a subdomain?
- A subdomain is a prefix added to a domain name, separated by a dot. For example, in 'blog.example.com', 'blog' is the subdomain of 'example.com'. Subdomains are used to organize different sections or services under a single domain, such as mail.example.com for email or api.example.com for an API.
- How does subdomain enumeration work?
- Subdomain enumeration works by testing a list of common subdomain names against a target domain via DNS lookups. For each candidate (e.g., 'www', 'mail', 'api'), the tool attempts to resolve the full hostname (like www.example.com) to an IP address. If the DNS query returns a valid A record, the subdomain exists.
- Is subdomain scanning legal?
- DNS lookups are public queries -- resolving domain names to IP addresses is a fundamental part of how the internet works. Subdomain enumeration using DNS is generally considered acceptable. However, you should only scan domains you own or have authorization to test, and always follow responsible disclosure practices.
- Why can't the tool find all subdomains?
- This tool checks a curated list of approximately 80 common subdomain names. Domains may have subdomains with custom or uncommon names that aren't in the wordlist. Additionally, some subdomains may use wildcard DNS, private DNS zones, or may not have public A records, which would prevent discovery through this method.
- How are subdomains used in SaaS platforms?
- SaaS platforms commonly use subdomains to provide tenant-specific access points (e.g., acme.app.com) or to support custom domain functionality where customers map their own subdomains to the platform. This requires DNS configuration (usually a CNAME record), SSL certificate provisioning, and request routing -- all of which can be automated with tools like SaaSKevin.
Need setup examples for real SaaS products? Browse our industry guides and explore all free domain tools.