Bounded DNS discovery

Subdomain Finder

Test common hostnames beneath a domain, confirm live A, AAAA, and CNAME records, and separate likely wildcard answers from distinct DNS evidence.

This is a bounded candidate scan, not a complete inventory. Certificate Transparency and other passive-history sources are not configured. Every displayed row was selected for direct DNS testing; unchecked or partial rows show where enforced limits prevented completion. The service checks only a finite built-in list plus your optional prefixes, performs DNS lookups only, and never opens discovered websites.

Domain name

Enter a public domain such as example.com. A pasted URL is reduced to its hostname.

Coverage

Larger candidate lists improve common-name coverage but still cannot prove completeness; limits may leave some rows unchecked.

Custom candidate prefixes 0 / 25

Extra single-label prefixes (optional)

One prefix per line or separated by commas, maximum 25. Enter only the part before the domain; for portal.example.com, enter portal.

Examples:

Standard selects up to 150 built-in labels; Thorough selects up to 300. Custom prefixes add at most 25, for a maximum of 325 candidate names. Enforced time and query budgets can leave selected candidates unchecked. Results come from the same-origin Octetify DNS service and may reflect resolver caches.

Subdomain scan complete

Live findings0

Candidates processed0

Distinct addresses0

Scan time—

Run details

Exact scope and timing

Wildcard DNS check

Random-label comparison

Apex DNS evidence

The queried domain itself

Candidate evidence

Live findings and inconclusive checks

Search evidence

Candidate source

Classification

Record evidence

Returned subdomain candidates and DNS evidence
			DNS answers		DNSSEC claim		Evidence

Warnings and coverage limits

Read before using the list

Coverage and method evidence

Raw response

Portable same-origin evidence

View complete JSON response

How to read a subdomain scan

Live DNS is not an active service

An A, AAAA, or CNAME answer shows that DNS data exists. It does not prove a website, mail service, or application is reachable, current, or authorized.

Wildcard DNS can create false leads

Some zones answer for almost any label. Random-label baselines help identify candidates that merely repeat that catch-all response; expand a row to compare evidence.

Absence is not proof

This tool tests a finite list. A missing hostname may use an untested name, private split-horizon DNS, delegated children, or records visible only from another resolver.