Domain discovery allows you to add domain you know about (for instance,
example.com) and let us find subdomains and alternate TLDs (such as
We use several methods to discover hostnames:
- 1.GuessingWe use a large database of potential subdomains and check whether they exist. This is also referred to as a brute force method. The checks are fast and light-weight so as to not overwhelm your DNS servers.
- 2.Databases & Public InformationWe use a variety of databases, certificate transparency logs, and other sources that contain subdomain records.
- 3.Third-party IntegrationsWe can easily integrate with your DNS servers like Amazon Route53, Azure, and Cloudflare to pull subdomains from your DNS records, or provide instructions for exporting a list from your DNS provider.
This process is run recursively, so if we discover
sub.example.comwe'll use that to discover deeper subdomains, such as
We call the domains you add to discovery seed domains and you can add those from your dashboard or by sending a list or CSV to our team. By default, we use the domain on your email address to seed your account initially.
Each week we'll run our discovery process and compile discovered subdomains. You can also run the discovery process on demand by visiting Discovery › Domain and clicking the refresh icon in the row of the domain you'd like to run the process on.
All hosts found during the domain discovery process are reflected in the Discovery › Overview report. You can filter discovered targets in the source dropdown to see only ones discovered with domain discovery, or from a specific domain.