Every internet-facing organization runs dozens, sometimes thousands, of subdomains. Each one is a potential entry point: a forgotten staging server, an exposed admin panel, a misconfigured API gateway. Subdomain discovery is the process of finding all of these assets so you can understand what you actually expose to the internet.
But not all discovery techniques are created equal. Some are quiet and non-intrusive, pulling information from public records without ever touching the target. Others are active, systematically probing DNS to uncover subdomains that no public source knows about. A thorough scan needs both.
At SubAnalyzer, every scan runs a unified pipeline that combines passive enumeration (light) with active brute-forcing (deep), followed by DNS resolution, port scanning, and enrichment. This article breaks down each phase so you know exactly what happens when you hit "Scan."
How light scans work
The light phase collects subdomains from public data sources without sending a single packet to the target's infrastructure. This makes it fast, safe, and invisible to the target. It's also the foundation that every scan starts with.
Certificate transparency logs
When a certificate authority issues an SSL/TLS certificate, it must publish the certificate to one or more public certificate transparency (CT) logs. These logs are append-only and publicly searchable, which means every certificate ever issued for a domain is recorded and accessible.
SubAnalyzer queries multiple CT log search engines to pull every subdomain that has ever appeared on a certificate for the target domain. This catches subdomains like staging.example.com or internal-api.example.com that were issued certificates even if they are no longer active. CT logs are often the single largest source of subdomain data.
Threat intelligence feeds
Threat intelligence platforms aggregate indicators of compromise from multiple feeds. When queried for a domain, they return subdomains that have appeared in threat intelligence data, sometimes revealing subdomains associated with phishing campaigns or compromised infrastructure that other sources miss entirely.
DNS databases
Several services maintain databases of DNS records collected through continuous internet-wide scanning. These provide a snapshot of known subdomains based on observed DNS data, complementing the certificate-based sources.
Together, these passive sources typically find the majority of a domain's known subdomains in seconds. But they share a fundamental limitation: they can only find subdomains that have been publicly recorded somewhere. Subdomains that were never issued a certificate, never appeared in threat feeds, and never showed up in internet-wide scans will be invisible to passive enumeration.
How deep scans work
The deep phase actively queries the target's DNS infrastructure to find subdomains that no public source has ever recorded. This is where the scan gets aggressive.
Wordlist brute-forcing
The core of active discovery is DNS brute-forcing: taking a wordlist of common subdomain names and resolving each one against the target domain. SubAnalyzer uses a curated wordlist of common prefixes like www, mail, api, dev, staging, admin, vpn, and thousands more.
Each candidate (e.g., dev.example.com) is resolved via DNS. If it returns an IP address, it exists. This technique catches internal-use subdomains that were never issued certificates and never appeared in any public database.
SRV record enumeration
SRV (Service) records are DNS entries that specify the host and port for specific services. Organizations use them for things like XMPP, SIP, LDAP, and Microsoft services. SubAnalyzer queries common SRV record patterns like _sip._tcp.example.com and _autodiscover._tcp.example.com to find services that would otherwise be invisible.
NS and MX record extraction
Nameserver (NS) and mail exchange (MX) records often point to subdomains that host critical infrastructure. By extracting and resolving these records, SubAnalyzer discovers mail servers, nameservers, and the subdomains behind them.
Zone transfer attempts
A DNS zone transfer (AXFR) is a mechanism for replicating DNS data between nameservers. When a nameserver is misconfigured, it may allow anyone to request a full copy of the zone, revealing every subdomain in a single response. Open transfers are rare on well-secured domains, but SubAnalyzer always attempts one because when it works, it gives you everything.
Wildcard detection
Some domains are configured with wildcard DNS records, meaning *.example.com resolves to an IP address regardless of the subdomain. Without wildcard detection, brute-forcing would return thousands of false positives. SubAnalyzer detects wildcards by resolving random, non-existent subdomains. If they resolve, the domain uses wildcards, and the scan filters results accordingly to avoid flooding you with noise.
DNS resolution
After passive and active discovery have assembled a combined list of subdomain candidates, every candidate needs to be resolved. SubAnalyzer uses a high-performance DNS stub resolver capable of resolving tens of thousands of names per second.
The resolution phase runs in two passes. The first pass resolves all candidates from both the light and deep phases. Subdomains that resolve successfully move forward. The rest are discarded. A second pass picks up any additional subdomains discovered during enrichment (like TLS SAN extraction, described below) and resolves those too.
The result is a deduplicated list of live subdomains with their resolved IP addresses, ready for port scanning.
Port scanning and enrichment
Knowing a subdomain exists is only half the picture. You also need to know what services it runs, who hosts it, and what organization owns the IP space. The final phase handles all of this.
Port scanning
SubAnalyzer uses a high-performance port scanner to scan the resolved IP addresses for common open ports. This reveals which subdomains are running web servers, mail servers, SSH, databases, and other services. Open ports are the clearest indicator of what a subdomain actually does.
TLS SAN extraction
When a subdomain serves HTTPS, its TLS certificate often contains Subject Alternative Names (SANs), additional domain names the certificate is valid for. SubAnalyzer connects to every subdomain with port 443 open and extracts the SANs from the certificate. This frequently uncovers subdomains that were not found by any other technique, because they share a certificate with a known subdomain but were never independently recorded.
Any new subdomains discovered through SAN extraction are fed back into the second DNS resolution pass, ensuring nothing is missed.
Organization and cloud provider detection
For each unique IP address, SubAnalyzer performs an ASN (Autonomous System Number) lookup to determine which organization owns the IP range. It also maps ASNs to known cloud providers, CDNs, and hosting platforms. This tells you whether a subdomain is hosted on your own infrastructure, a cloud provider like AWS or Azure, a CDN like Cloudflare or Akamai, or a third-party service you may not have been aware of.
How they work together
No single technique finds everything. Passive sources are fast and comprehensive for known subdomains, but they miss anything that has never been publicly recorded. Active brute-forcing catches those hidden subdomains, but it is limited by the wordlist. TLS SAN extraction finds subdomains that neither technique would catch on its own.
By running every technique in sequence and feeding results between phases, SubAnalyzer builds the most complete picture possible:
- Passive enumeration provides a broad baseline from CT logs, threat intelligence, and DNS databases.
- Active brute-forcing uncovers subdomains that exist in DNS but have never been publicly indexed.
- DNS resolution filters candidates down to live subdomains with real IP addresses.
- Port scanning reveals what services each subdomain runs.
- TLS SAN extraction discovers additional subdomains from certificates and feeds them back for resolution.
- ASN lookup maps each IP to its owning organization and cloud provider, giving you hosting context.
The result is a complete inventory of subdomains, their IP addresses, open ports, hosting providers, and organizational ownership, all from a single scan.
Try it
Want to see what your attack surface looks like? Start a free scan and see every subdomain, open port, and hosting provider in one place.