Subdomain Finder

Robtex finds subdomains by using passive DNS observations, a decade of historically observed DNS records. Find all known subdomains for any domain and reveal infrastructure, services, and third-party integrations.

What subdomain enumeration finds

Subdomains are domain names under a parent domain. For example,api.example.com,cdn.example.com, andmail.example.comare subdomains ofexample.com. Robtex's passive DNS database contains observed DNS queries and answers from the past decade, allowing us to list every subdomain that has ever received a DNS answer.

Subdomain enumeration is useful for security research, infrastructure discovery, and understanding the full scope of a domain's services.

How to use it

Open example passive DNS data for example.com

Open the passive DNS API result

Enter a domain name and Robtex returns all observed subdomains from the passive DNS database, along with the record types and IP addresses (or other targets) each subdomain currently resolves to.

DNS observability

Robtex tracks passive DNS, what resolvers and sensors actually observed, not what a domain owner intended to publish. This means the subdomain list reflects real infrastructure that existed and received DNS traffic, not a comprehensive registry. Subdomains that were never queried by a resolver or observed by a sensor will not appear in the passive DNS database.

The subdomains list may include development, testing, internal, and retired infrastructure. Always treat passive DNS results as evidence of historical infrastructure, not as a definitive security scan.

When to use subdomain enumeration

Security researchers use subdomain enumeration to find forgotten or unpatched services, identify third-party integrations, and map the full attack surface of a domain. Operators use it to audit their own infrastructure and discover subdomains they may not have configured themselves (perhaps added by contractors, acquired companies, or legacy systems). Penetration testers use subdomain lists as input to service discovery and vulnerability scanning workflows.

API and agent access

Robtex exposes subdomain enumeration and passive DNS through web pages, APIs, and agent integrations:

Use DNS Lookup to query a specific domain or subdomain. Use DNS History to see how a domain's DNS records have changed over time. Use Reverse DNS Lookup to find domains that point to a specific IP address.

FAQ

What is a subdomain?
A subdomain is a domain name that is part of a larger domain. For example,api.example.comis a subdomain ofexample.com. A domain can have an unlimited number of subdomains.
How does Robtex find subdomains?
Robtex's passive DNS database contains observed DNS resolution history since around 2013. When you query for subdomains of a domain, Robtex returns every subdomain in its database that has received a DNS answer.
Will the subdomain list find all subdomains?
No. Passive DNS only contains subdomains that were actually queried and observed by a resolver or sensor. Subdomains that exist in DNS but were never queried will not appear in the results.
Are internal or development subdomains included?
Possibly. If internal subdomains were queried by a resolver and observed, they may appear in the passive DNS database. Always assume the results could include development, testing, or retired infrastructure.
Is subdomain enumeration free?
Yes. The web lookup is free and does not require login. API and MCP integrations are available for programmatic use.
What should I do if I find an unfamiliar subdomain?
Investigate it. An unfamiliar subdomain might be a legacy system, a contractor's addition, a former acquisition, or an attacker's staging point. Use other tools like DNS Lookup and IP Reputation to learn more about what the subdomain points to and who operates it.