🕵️

Subdomain Finder

Discover subdomains via DNS brute-force of ~120 common prefixes.

GET /v1/subdomains

curl "https://dns.toolkitapi.io/v1/subdomains?domain=github.com"

import httpx

resp = httpx.get(
    "https://dns.toolkitapi.io/v1/subdomains?domain=github.com",
)
print(resp.json())

const resp = await fetch("https://dns.toolkitapi.io/v1/subdomains?domain=github.com", {
});
const data = await resp.json();
console.log(data);

# See curl example

Response 200 OK

{
  "domain": "github.com",
  "subdomains_checked": 120,
  "subdomains_found": 4,
  "results": [
    {"subdomain": "www.github.com", "ips": ["140.82.121.3"], "cname": null},
    {"subdomain": "api.github.com", "ips": ["140.82.121.6"], "cname": null},
    {"subdomain": "mail.github.com", "ips": ["192.30.252.192"], "cname": null},
    {"subdomain": "docs.github.com", "ips": [], "cname": "github.github.io"}
  ],
  "query_time_ms": 4523.8
}

Try It Live

Description

Discover subdomains via DNS brute-force of ~120 common prefixes.

How to Use

1

1. Pass the target domain in the `domain` parameter. 2. The API checks ~120 common prefixes concurrently. 3. Review `results` for discovered subdomains with their IPs and CNAMEs.

About This Tool

Subdomain Finder checks ~120 common subdomain prefixes (www, mail, api, dev, staging, admin, cdn, etc.) via DNS resolution. It returns all subdomains that resolve to an IP address or CNAME, along with the resolved addresses.

This is a passive reconnaissance technique — it only queries DNS and does not connect to any discovered hosts.

Why Use This Tool

Security audit — Discover exposed subdomains (staging, dev, admin panels)
Attack surface mapping — Identify all publicly-resolvable subdomains
Infrastructure discovery — Map a company's public-facing services
DNS cleanup — Find stale subdomains pointing to decommissioned IPs

Frequently Asked Questions

Which prefixes are checked?

~120 common prefixes including www, mail, smtp, ftp, api, dev, staging, admin, cdn, vpn, ns1, ns2, and many more.

Does this connect to discovered hosts?

No — it only performs DNS lookups. No HTTP connections or port scans.

Start using Subdomain Finder now

Get your free API key and make your first request in under a minute.

Get Free API Key View Docs