Start with the live form
Enter a domain, URL, IP, email, or record and get a focused result without setup.
All tools
Web Data
Domain Intelligence
DNS & Infrastructure
Security & Trust
Identity & Verification
Monitoring & Automation
Subdomain Finder
Review public hostname evidence with clear source labels
Searching for subdomains...
Subdomains found (0)
API endpoint
GET /v1/subdomains?domain=example.com
Interactive intelligence tool
Run the check, then ship the workflow
Use the browser tool for a fast answer, then move the same logic into scripts, monitoring, or product flows when it becomes repeatable.
Review decision-ready signals
Outputs highlight statuses, risks, records, and next actions instead of raw provider noise.
Automate the workflow that works
Use the request and response examples to turn a one-off check into an API call or recipe.
Used by people at these companies
What this tool helps you decide
Each page is shaped around a practical operational question, not just a raw lookup.
See the current DNS, registration, security, pricing, or reputation evidence.
Compare the result with related checks so the next move is easier to trust.
Copy examples, open linked tools, or move into API documentation when you need scale.
Trust signals before you integrate
Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.
Live
Service status
Check live service health and documented failure responses before you integrate.
OpenAPI
API artifacts
OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.
API keys
Protected access
Authenticated endpoints use API keys with clear credit costs before you call them.
10,000
Free allowance
Start with 10,000 monthly credits and upgrade only when usage grows.
Key Features
Subdomain Finder - Free Tool | DomScan
No. This is best-effort passive coverage. Internal names and public hosts missing from the source datasets will not appear, and DNS verification does not search for additional names.
Find subdomains
Compare the result with a known asset list, review old hostnames, or seed an authorized security inventory. Because passive coverage has gaps, this should not be your only discovery method.
Check domain health
Use GET /v1/subdomains?domain=example.com&sources=ct. The ct value selects the compatibility pipeline, while each entry reports its actual evidence source. Cache-only misses return 202 and all-source failures return 503; both refund credits.
Example request
GET /v1/subdomains?domain=example.com&sources=ctExample response
{
"domain": "example.com",
"subdomains": [
{
"name": "api.example.com",
"source": "crtsh",
"first_seen": "2025-01-15T00:00:00Z",
"verified": false,
"dns_records": null
}
],
"summary": {
"total_found": 1,
"returned": 1,
"verified_count": 0,
"unverified_count": 1,
"sources_used": ["crtsh"],
"apex_included": false,
"wildcard_suppressed_count": 0,
"wildcard_returned_count": 0
},
"intelligence_summary": {
"data_sources": ["crtsh"],
"source_count": 1,
"cache_status": "live",
"returned_count": 1,
"total_found": 1,
"truncated": false,
"limit": 500,
"verification_requested": false,
"include_wildcards": false,
"verified_count": 0,
"verified_ratio": 0,
"live_dns_record_count": 0,
"apex_included": false,
"wildcard_suppressed_count": 0,
"wildcard_returned_count": 0,
"first_seen_oldest": "2025-01-15T00:00:00Z",
"first_seen_newest": "2025-01-15T00:00:00Z",
"warning_count": 0
},
"meta": {
"query_time_ms": 184,
"cached": false
}
}Built on the same API
The browser experience previews DomScan's structured endpoints, so teams can validate a use case before writing code.
Frequently asked questions
How does subdomain discovery work?
No. This is best-effort passive coverage. Internal names and public hosts missing from the source datasets will not appear, and DNS verification does not search for additional names.
Why would I want to find a domain's subdomains?
Compare the result with a known asset list, review old hostnames, or seed an authorized security inventory. Because passive coverage has gaps, this should not be your only discovery method.
Are these all the subdomains that exist?
No. This is best-effort passive coverage. Internal names and public hosts missing from the source datasets will not appear, and DNS verification does not search for additional names.
Is there an API for automated subdomain enumeration?
Use GET /v1/subdomains?domain=example.com&sources=ct. The ct value selects the compatibility pipeline, while each entry reports its actual evidence source. Cache-only misses return 202 and all-source failures return 503; both refund credits.