Softonic

Subdomain Finder

Step 1 / 2
Next

Before you inventory a domain, the first question is simple: does its most common subdomain actually resolve? This basic subdomain finder takes a domain you provide, builds its www host, and runs a live DNS lookup (A, AAAA and CNAME) so you can see whether it is configured and where it points. It is a quick starter check, not a full enumeration. To discover mail gateways, staging environments, admin portals and other hidden hosts, you still need a dedicated recon tool such as amass or subfinder that pulls from certificate transparency logs and passive DNS.

How the check works

  1. 1

    Enter a domain

    Paste a bare domain such as `example.com`. The tool removes any `http://` or `https://` prefix and any path, then checks that what remains looks like a valid domain.

  2. 2

    Run the lookup

    The tool forms the `www` host for your domain and performs a live A / AAAA / CNAME DNS query through the server resolver.

  3. 3

    Read the records

    If `www` resolves, its IPv4 (A) and IPv6 (AAAA) addresses or its CNAME target are listed. If nothing resolves, no result is shown.

  4. 4

    Pivot from there

    For a fuller picture, run a certificate transparency search (crt.sh) or a wordlist recon tool, then examine the hosts you find in Burp, Nmap or a screenshot tool.

What this basic check does

This tool is deliberately minimal: it queries a single, well-known prefix, www, and reports the DNS records it returns. It does not brute-force a large wordlist, read certificate transparency logs, or query passive DNS, so it will not surface uncommon or internal hostnames. Treat a positive result as confirmation that the domain’s main web host is live, and a negative result as a prompt to try the bare domain or a full recon tool.

What “basic” means

Technique This tool Full recon platform
Live DNS lookup of the www prefix Yes Yes
Large brute-force prefix wordlist No Yes (10k to 10M)
Certificate Transparency logs No Yes
Passive DNS history No Yes
Search engine scraping No Yes
Wildcard DNS detection No Yes
Finishes in seconds Yes Minutes to hours

Responsible use

  • Only look up domains you own or are authorised to assess. A DNS query is passive, but pivoting from the result into port scans or HTTP requests can be treated as unauthorised access in many jurisdictions.
  • Respect bug bounty scope. Most programs exclude *.internal, .corp and third-party staging environments from rewards.
  • A live www is only a starting point. One resolving host says nothing about the rest of the attack surface, so use a full recon tool before drawing conclusions.

Interpreting CNAME results

If the result is a CNAME instead of an IP address, the subdomain is an alias pointing at another hostname. A target like *.cloudfront.net, *.azureedge.net, *.herokuapp.com or ghs.googlehosted.com tells you which CDN or SaaS vendor hosts it. A dangling CNAME, where the target no longer exists, is a classic subdomain-takeover vector worth investigating if the domain once used a terminated service.

Frequently Asked Questions

This basic check only queries one prefix, www. Mail gateways, api, staging, internal names and region-specific hostnames will never appear. Combine a certificate transparency search (crt.sh) with a larger wordlist recon tool such as amass or subfinder when you need real coverage.

A DNS query is a public lookup that every browser makes, so on its own it is not intrusive. Using the result to probe systems you do not own can still violate computer-access laws, so only look up domains you are authorised to assess.

A CNAME record is an alias that points to another hostname rather than directly to an IP address. The tool shows the target so you can see which CDN or SaaS vendor hosts the subdomain.

Either www is not configured for that domain, or the upstream DNS resolver was slow or rate-limited. Check the bare domain in a DNS lookup tool, and if you expected a result, wait a moment and try again.

The lookup runs live through our server, and standard anonymous usage analytics record that a scan happened, including the domain checked and how many records were found. The DNS results themselves are not stored beyond your session.

Related Tools

What Is My IP

See the IP address this server received for your request, its IPv4 or IPv6 family, and an approximate country when local GeoIP data is available.

IP Address Lookup

Look up any public IPv4 or IPv6 address for approximate country, region, city, coordinates, ISP, ASN, organization and timezone.

Speed Test

Run a fast, free, browser-based internet speed test. Measure your download speed in Mbps plus round-trip latency and jitter, and see whether your connection is ready for 4K streaming, gaming and video calls, no app, no signup.

DNS Lookup

Query the A, AAAA, MX, TXT, NS, CNAME and SOA records of any domain without opening a terminal.

Reverse DNS Lookup

Look up the PTR record for an IPv4 or IPv6 address. Useful for mail-server debugging, log analysis and spam-filter investigations.

WHOIS Lookup

Look up public WHOIS registration data for a domain: registrar, nameservers, status codes and expiry dates.

Tool available in other languages