Subdomain Checker

Check which common subdomains exist for a domain. Enter a domain and this tool queries a fixed list of frequently used names — www, mail, api, dev, admin and many more — and shows the ones that resolve, with the IP address or CNAME target they point to.

What a subdomain is

A subdomain is a name placed in front of your domain: in mail.example.com, the subdomain is mail and example.com is the domain. Organisations use subdomains to separate services — a website on www, webmail on mail, an API on api, internal tools on admin or intranet, and so on. Each one is its own DNS name with its own records.

Because subdomains multiply quickly across teams and projects, they are easy to forget. That makes them interesting both to administrators (to map what is actually in use) and to attackers (to find forgotten services). This tool checks a fixed, well-known list rather than brute-forcing, so it shows you the usual suspects without generating heavy traffic.

Why you should check them

• Inventory. See which well-known names are live so you know what to maintain and monitor.
• Staging leaks. dev, staging and test systems often lack the protections of production but still hold real data.
• Subdomain takeover. If a subdomain's CNAME points to a hosting service that is no longer claimed, someone else can register that service and serve content under your domain.
• Header and cookie scope. Cookies set on the parent domain are sent to subdomains, so a weak subdomain can expose them.
• Certificate coverage. Make sure your TLS certificate and redirects cover the subdomains you actually use.

Reading the results

Each entry shows the subdomain, the fully qualified name, the record type (A or CNAME), the value it resolves to and its TTL. Addresses in reserved ranges — such as 0.0.0.0 or 192.0.2.x — usually mean the name exists but is intentionally parked or used internally; treat those as "exists, not a live public service".

Protecting your own domain

1. Keep an inventory. Record every subdomain you create and remove the ones you retire.
2. Watch dangling CNAMEs. Before deleting a service, remove its DNS record so the target can never be re-registered by someone else.
3. Protect staging. Put authentication and network restrictions on non-production systems.
4. Use a wildcard only deliberately. A wildcard record makes every subdomain resolve, which can hide problems and complicate takeovers.
5. Extend certificates. Include the subdomains you use in your TLS certificate so users never hit a name mismatch.

Privacy, ethics and limits

This tool performs standard public DNS lookups for a fixed list of names — it does not attempt to guess private names or bypass any access controls. Because subdomain enumeration can be abused, this endpoint carries a stricter rate limit than the other tools. Please only check domains you own or are authorised to assess.