Frequently asked questions

Enter the domain in the scan box to search for its subdomains. A light scan reads public sources such as certificate transparency logs and passive DNS data. A deep scan then asks live DNS for likely names, looks up SRV records and tries a zone transfer, and keeps the guessed names that resolve. No tool can promise every subdomain, because a name that never appears in public DNS, certificates or datasets can stay hidden. Our guide to subdomain enumeration covers 12 methods, with a command to try each one.

A subdomain finder, also called a subdomain scanner or subdomain checker, is a tool that discovers the subdomains associated with a domain name. It scans public records, DNS data and other sources to reveal subdomains like mail.example.com or dev.example.com that may not be immediately visible. SubAnalyzer's subdomain finder does this for any domain you enter.

Yes. Every scan checks each subdomain's CNAME against cloud and SaaS services where an unclaimed name can be registered by someone else, including Azure services, AWS S3 and Elastic Beanstalk. Free scans flag subdomains with potential takeover risks. Paid plans also identify the affected service, so you know how to fix it. Our guide on how subdomain takeover happens and how to prevent it explains the risk.

Yes. With a paid plan, SubAnalyzer scans up to 10 monitored domains daily and alerts you by email, Slack, Microsoft Teams or webhook when something changes. Alerts cover new or removed subdomains, CNAME changes, cloud provider changes, open port changes, takeover risks and changes to your email setup. Takeover risks appear first, and you choose which changes trigger an alert.

Yes. You can scan or look up 2 domains a day for free. With a free account, you can save scans to your dashboard and keep accessing them after you reach your daily limit. The free view shows up to 1,000 subdomains from the light scan and the first page of screenshots, and flags every takeover risk. Paid plans start at $12.50 a month, billed yearly, and show all subdomains found by both light and deep scans. They include up to 100 new domains a month, takeover risk details, the full AI summary, all screenshots, change history, monitoring for up to 10 domains, re-scans on demand and exports to CSV or JSON. Your first Monthly subscription starts with a 7-day free trial, which includes 25 new domains. Visit our pricing page for details.

Each Monthly or Yearly plan includes 100 new domains a month, and each month starts on your billing day, on Yearly plans too. A domain counts the first time you scan it in a month, and scanning it again that month is free. Opening results that already exist and monitoring scans never count, and unused domains do not carry over. The 7-day free trial includes 25 new domains, and the monthly 100 start with your first paid month, which you can start before the trial ends. If you need more on a paid plan, add 100 domains for $15 or 500 for $59. Extra domains are used after your monthly 100 and stay valid for 12 months.

At most one a day, and only when something changed, with takeover risks at the top. Quiet days send nothing. You choose which kinds of change count for each domain, and you can turn email off for any domain from the email itself.

Yes. Under Alert channels on the Monitored tab, add a Slack incoming webhook, a Microsoft Teams workflow or your own HTTPS webhook, up to five. Each monitoring report goes there as well as by email, and a webhook receives it as signed JSON. Send a test from the same place to check the connection.

Each scan lists the subdomains it found with their IP addresses, network owner, open ports and HTTP status codes, plus the cloud provider when it is a major cloud, and checks every CNAME for takeover risk. The first page of screenshots is free, and on a paid plan every web-facing subdomain shows its screenshot and page title. See which ports SubAnalyzer scans for the full list.

No. SubAnalyzer works from the outside. Enter a domain and the results appear in your browser. There are no agents to install and no DNS or cloud credentials to share.

Finding subdomains starts with public data such as DNS records and certificate transparency logs. The deep scan also asks DNS about likely names, and a scan connects to common ports and loads web pages the way any visitor would, from SubAnalyzer's own servers. It never attempts an exploit and installs or changes nothing. The rules differ by country, so scan domains you own or have permission to test.

A light scan uses passive sources like certificate transparency logs to quickly find known subdomains. A deep scan adds active techniques such as DNS brute-forcing, SRV record lookups and zone transfer attempts to uncover subdomains that passive methods miss. Every scan runs both. The free view shows light scan results. Paid plans also include deep scan results. Read how the light and deep scans work for details.