Subdomain Scanner & Finder
Find active subdomains for any domain with our free subdomain scanner. Test common hostname patterns, resolve DNS records, and detect wildcard DNS automatically.
How the Subdomain Scanner Works
Fast subdomain discovery with wildcard DNS protection and active DNS resolution.
Common Pattern Testing
The scanner checks common subdomain names such as api, mail, dev, staging, admin, blog, shop, and other frequently used patterns.
Wildcard DNS Detection
Before scanning, the tool tests for wildcard DNS so it can avoid returning large lists of false positives.
DNS Resolution
Each candidate is resolved through DNS to check whether the subdomain has an active public record such as A, AAAA, or CNAME.
Useful Discovery Results
The tool focuses on practical, common subdomain discovery instead of returning noisy wildcard-driven results.
What Is a Subdomain?
A subdomain is a hostname that exists under a main domain. For example, in api.example.com, the word api is the subdomain.
Organizations use subdomains to separate websites, applications, APIs, staging environments, region-specific content, portals, and mail services.
Common examples include www, mail, blog, api, and shop.
What a Subdomain Scanner Can and Cannot Do
A subdomain scanner can help find publicly resolving subdomains by testing common hostname patterns and checking their DNS records.
- It can identify common subdomains that resolve through DNS.
- It can show which subdomains use A, AAAA, or CNAME-style resolution.
- It cannot guarantee that every existing subdomain will be discovered.
- It does not prove that a discovered subdomain hosts a live website or application.
Why Subdomain Discovery Matters
Security and IT Use Cases
Subdomain discovery is useful for security reviews, infrastructure audits, DNS troubleshooting, and migration planning.
- Finding staging, development, admin, or forgotten public hostnames.
- Auditing public infrastructure during hosting or DNS migrations.
- Reviewing external DNS footprint and visible asset inventory.
Why Wildcard DNS Detection Matters
Some domains use wildcard DNS records such as *.example.com. When that happens, many random hostnames can resolve even if no real subdomain exists.
That can create large numbers of false positives in subdomain scanners. DNSLookup.ca checks for wildcard behavior first so your results stay cleaner and more useful.
DNS Record Types
Discovered subdomains usually resolve through common record types such as:
Active vs Live Website
A subdomain can resolve in DNS without hosting a working website.
In this tool, “active” means the DNS record exists and resolves. It does not confirm that the host serves live content over HTTP or HTTPS.
Why Results Differ Between Tools
Different tools may produce different subdomain results because of:
- Different wordlists or pattern libraries
- Timeout and retry behavior
- Wildcard DNS filtering quality
- Resolver or cache differences
Common Subdomains Often Found on Websites
These are examples of common naming patterns frequently checked by subdomain scanners.
Frequently Asked Questions
What is a subdomain scanner?
A subdomain scanner is a tool that tests common hostname patterns against a domain to discover publicly resolving subdomains.
How do I find subdomains of a domain?
Enter the target domain into our subdomain scanner. The tool checks common naming patterns and returns subdomains that resolve through DNS.
What is wildcard DNS?
Wildcard DNS uses an asterisk record such as *.example.com to resolve many non-existent subdomains to a default DNS answer. This can create false positives if a scanner does not filter for it.
Are all discovered subdomains active websites?
No. A discovered subdomain only means it has an active DNS record. It may point to a website, an API, a mail system, or another type of infrastructure.
Why do subdomain scanner results vary between tools?
Results differ because tools use different wordlists, timeout settings, wildcard filtering methods, and DNS resolution behavior.
Is subdomain scanning the same as a DNS lookup?
No. A DNS lookup checks records for a specific known hostname. A subdomain scanner tests many possible hostnames to discover which ones actually exist.
Can discovered subdomains use CNAME records?
Yes. Many subdomains resolve through CNAME records, especially when they point to cloud platforms, hosted services, or external infrastructure.
Is this subdomain scanner free?
Yes. DNSLookup.ca provides this subdomain scanner and finder free to use.