Subdomain scanner
Subdomain Finder
Find the active subdomains for any domain. The scanner tests common hostname patterns, resolves their DNS records, and detects wildcard DNS to keep results clean.
How it works
How the subdomain scanner works
Fast subdomain discovery with wildcard DNS protection and active DNS resolution.
Common Pattern Testing
Checks common subdomain names such as api, mail, dev, staging, admin, blog, and shop.
Wildcard DNS Detection
Tests for wildcard DNS first so it can avoid returning large lists of false positives.
DNS Resolution
Resolves each candidate through DNS to check for an active A, AAAA, or CNAME record.
Useful Results
Focuses on practical, common subdomain discovery instead of noisy wildcard-driven results.
What is a subdomain?
A subdomain is a hostname under a main domain. In api.example.com, api is the subdomain.
Organizations use subdomains to separate websites, apps, APIs, staging environments, region-specific content, portals, and mail services.
Common examples include www, mail, api, and shop.
What it can and can't do
- It can identify common subdomains that resolve through DNS.
- It can show which subdomains use A, AAAA, or CNAME-style resolution.
- It cannot guarantee that every existing subdomain will be discovered.
- It does not prove that a discovered subdomain hosts a live website.
Why subdomain discovery matters
Security and IT use cases
Subdomain discovery is useful for security reviews, infrastructure audits, DNS troubleshooting, and migration planning.
- Finding staging, development, admin, or forgotten public hostnames.
- Auditing public infrastructure during hosting or DNS migrations.
- Reviewing external DNS footprint and visible asset inventory.
Why wildcard DNS detection matters
Some domains use wildcard DNS records such as *.example.com. When that happens, many random hostnames resolve even if no real subdomain exists.
That creates large numbers of false positives in subdomain scanners. DNSLookup.ca checks for wildcard behavior first so your results stay cleaner and more useful.
DNS record types
Discovered subdomains usually resolve through common record types:
Active vs live website
A subdomain can resolve in DNS without hosting a working website.
Here, "active" means the DNS record exists and resolves. It does not confirm the host serves live content over HTTP or HTTPS.
Why results differ between tools
Different tools may produce different results because of:
- Different wordlists or pattern libraries
- Timeout and retry behavior
- Wildcard DNS filtering quality
- Resolver or cache differences
Common subdomains found on websites
Examples of common naming patterns frequently checked by subdomain scanners.
Answers
Frequently asked questions
What is a subdomain scanner?
A subdomain scanner is a tool that tests common hostname patterns against a domain to discover publicly resolving subdomains.
How do I find subdomains of a domain?
Enter the target domain into our subdomain scanner. The tool checks common naming patterns and returns subdomains that resolve through DNS.
What is wildcard DNS?
Wildcard DNS uses an asterisk record such as *.example.com to resolve many non-existent subdomains to a default DNS answer. This can create false positives if a scanner does not filter for it.
Are all discovered subdomains active websites?
No. A discovered subdomain only means it has an active DNS record. It may point to a website, an API, a mail system, or another type of infrastructure.
Why do subdomain scanner results vary between tools?
Results differ because tools use different wordlists, timeout settings, wildcard filtering methods, and DNS resolution behavior.
Is subdomain scanning the same as a DNS lookup?
No. A DNS lookup checks records for a specific known hostname. A subdomain scanner tests many possible hostnames to discover which ones actually exist.
Can discovered subdomains use CNAME records?
Yes. Many subdomains resolve through CNAME records, especially when they point to cloud platforms, hosted services, or external infrastructure.
Is this subdomain scanner free?
Yes. DNSLookup.ca provides this subdomain scanner and finder free to use.
Keep digging
Inspect a subdomain's full DNS
Run a DNS record lookup on any subdomain you found, or check the whole domain's health.