FAQs
The Deep scan uses multiple techniques to find subdomains fast and effectively:
- DNS records (NS, MX, TXT, AXFR)
- Enumeration using built-in wordlists, plus the option to use your own.
- External APIs search.
- Public search engine queries (Google search, Bing)
- Word mutation techniques.
- Searching in SSL certificates.
What is the best tool to find subdomains? ›
The Best Subdomain Enumeration Tools
- Google Dorking. Google Dorking is a passive subdomain enumeration technique using Google's advanced search operators, like "site:" to find information about a target, including subdomains. ...
- Sublist3r. ...
- Amass. ...
- Recon-ng. ...
- SubDomainizer. ...
- Pentest Tools Subdomain Finder. ...
- crt.sh. ...
- Shodan.
Are subdomains bad for SEO? ›
As long as you use them correctly, subdomains are fine for your SEO performance.
How to search subdomains in Google? ›
By search engines
Search engines like Google supports various advanced search operators to refine search queries. These operators are often referred to as Google Dorks. We can use site: operator in Google search to find all the Subdomains that Google has found for a Domain. Lets take an example on “site:vulnweb.com”.
Are subdomains searchable? ›
YES. Search engines index subdomains – this has been established.
How does Google view subdomains? ›
However, Google treats subdomains as separate sites.
While “blog.example.com” and “example.com” may share a root domain, Googlebot will view them as distinct domains and crawl and index them accordingly.
What is the most used subdomain? ›
The most common subdomain is “www” or “world wide web.” The subdirectory points users to the main directory of a website—in other words, where your homepage and other core pages live. Other subdomains work to create distinct parts of a site. For example, Google's root domain is www.google.com.
How does subdomain finder work? ›
Subdomain Finder scans the DNS records and supplementary databases to analyze the domain's hierarchy. Our subdomain scanner checks: DNS records (NS, MX, TXT, AXFR) DNS enumeration.
Do I own all subdomains? ›
Let's say you are making a pitch to a client to create their new website. You can create a subdomain that is specifically intended for them to give an idea of what their new website might look like. This is hosted on your own main domain, while retaining ownership of the subdomain.
How many subdomains is too many? ›
A domain can have up to 500 subdomains. You can create multiple levels of subdomains such as store.product.yoursite.com, test.forum.yoursite.com, etc. Each subdomain can be up to 255 characters long, but for multi level subdomains, each level can only be 63 characters long.
A sitemap is a file of your site's pages, links and other information that helps Google read and index your site. Each subdomain has its own dedicated sitemap that needs to be submitted to Google individually. Tip: You can check your subdomain's sitemap in the address bar by adding /sitemap.
What are the disadvantages of subdomains? ›
There are two disadvantages: A subdomain works like a separate domain in terms of authority: you would have to spend more time and money for building the authority for your root domain compared to when the blog was under a /subdirectory/ or on /separate-pages/.
What is subdomain hunting? ›
Subdomain hijacking, also known as dangling DNS, occurs when a threat actor gains control of a subdomain of a legitimate domain.
Does Google Domains allow subdomains? ›
Yes you can do this. Sub domains are treat no differently to regular domains. Only decision to make is if you want to leverage as an alias domain or secondary domain.
Which Google Dork helps us to find subdomains? ›
One of the benefits of Google Dorking is that it can be used for subdomain enumeration. This is done by searching for the "site:" operator in Google, followed by the target domain. For example, searching for "site:example.com" will return a list of all websites that are hosted on the example.com domain.
How do I get all DNS records for a domain including subdomains? ›
Using a terminal and the command nslookup is the most effective way to search a domain's DNS records. On almost all operating systems, this command works perfectly and displays all DNS records for the domain.
How many subdomains does a domain have? ›
A domain can have up to 500 subdomains. You can create multiple levels of subdomains such as store.product.yoursite.com, test.forum.yoursite.com, etc. Each subdomain can be up to 255 characters long, but for multi level subdomains, each level can only be 63 characters long.
Where are subdomains located? ›
A subdomain, on the other hand, is another part of the URL structure that goes before the domain name. As its main purpose is for site organization, your website can work fine without it.
Are subdomains included with the domain? ›
Subdomains are used to expand the use of a single domain, these do not need to be purchased separately to your domain; if you own a domain then you can add a subdomain to this. This method is commonly used for Moodle and Totara site setups.