Discover public host records under a domainSubdomain lookup aggregates public sources and returns exportable host records.
SUBDOMAINHOSTSOURCESTOTALEXPORTJSONCSV
Find DNS Host Records (Subdomains)
Best-effort discovery from public sources. Results can be incomplete.
How This Query Works
Subdomain discovery aggregates passive public feeds, normalizes hostnames, and removes duplicates under the target root zone.
- 1Input should be one root domain (for example example.com).
- 2Only in-scope hosts ending with the target root are retained after normalization.
- 3Source labels indicate where each hostname was observed, useful for confidence scoring.
- 4Use JSON/CSV export for inventory baseline, drift checks, and external enrichment.
Subdomain discovery uses public data only and may not be complete.