Google PlayGoogle Play
Temp Mail Logo

Temp Mail safeguards your privacy while keeping your inbox free from spam.

🔍 DNS Enumeration · 60+ Common Subdomains · IP Resolution · Live Scan

Subdomain Finder

Free subdomain finder. Scan any domain for common subdomains using live DNS lookup. Discover www, mail, api, admin, dev, staging, and 60+ other commonly used subdomains instantly.

✓ 60+ subdomains checked✓ Live DNS scan✓ IP addresses shown✓ Progress indicator✓ No signup
Enter a domain to scan for common subdomains
What this tool does

Free subdomain finder: discover DNS subdomains for any domain using live DNS enumeration

How subdomain scanning works and what results mean

This subdomain finder performs live DNS A-record lookups for 60+ commonly used subdomain names against any domain you specify. It checks subdomains like www, mail, api, admin, dev, staging, test, blog, shop, cdn, docs, status, vpn, git, and more. All the names that organisations routinely use for their web infrastructure. Any subdomain that resolves to an IP address is displayed in the results table.

Subdomain discovery is useful for mapping an organisation's internet-facing infrastructure, verifying that all expected services are accessible after a DNS migration, identifying forgotten or development subdomains that shouldn't be publicly accessible, and understanding what services a domain operates. The scan runs in your browser via parallel DNS queries to minimise wait time.

FAQ

Frequently asked questions about subdomain finding and DNS enumeration

How does subdomain finding work?
This tool performs DNS A-record lookups for a predefined list of common subdomain names against your target domain. For example, for example.com it checks www.example.com, mail.example.com, api.example.com, etc. If the DNS query returns an A record (IP address), the subdomain exists. This is called DNS brute-forcing or subdomain enumeration. It only finds subdomains in our wordlist. It cannot find custom or randomly named subdomains.
What subdomains does this tool check?
The tool checks 60+ of the most commonly used subdomain names including: www, mail, email, smtp, pop, imap, api, app, dev, staging, test, beta, admin, portal, blog, shop, cdn, static, docs, help, support, status, vpn, remote, secure, login, auth, git, monitoring, mx, ns, dns, webmail, cpanel, autodiscover, and more. This covers the vast majority of subdomains that organisations commonly use.
Is subdomain enumeration legal?
Subdomain enumeration via public DNS queries is generally considered legal for your own domains or for security research on domains you have permission to test. DNS is a public protocol designed for public queries. Looking up whether a subdomain exists via DNS is no different from visiting a website. However, you should only enumerate subdomains of domains you own or have explicit permission to test. Never use subdomain enumeration as part of an unauthorised security assessment.
Why are some known subdomains not showing up?
This tool only checks subdomains in its built-in wordlist. Subdomains with custom names (like portal.mycompany.com where 'portal' is in the list, but custom-project-name.mycompany.com is not) won't be found. Additionally, some organisations use wildcard DNS (*.example.com) where every subdomain returns an IP. This tool doesn't currently filter out wildcard responses. For comprehensive subdomain discovery, tools like Subfinder, Amass, or Certificate Transparency logs provide broader coverage.
Related Tools
WHOIS LookupDNS Lookup ToolDNS Propagation CheckerSSL Certificate CheckerAll Tools

Need a disposable email address?Get a free instant throwaway email. No signup, no trace.

Get Free Temp Mail →