Domain Discovery

Domain discovery allows you to add domains you know about (for instance, example.com) and let us find subdomains and alternate TLDs (such as example.net).

Detection Methods

We use several methods to discover hostnames:

1. Guessing

   We use a large database of potential subdomains and check whether they exist. This is also referred to as a brute force method. The checks are fast and lightweight to not overwhelm your DNS servers.

2. Databases & Public Information

   We use a variety of databases, certificate transparency logs, and other sources that contain subdomain records.

3. Third-party Integrations

   We can easily integrate with your DNS servers like Amazon Route53, Azure, and Cloudflare to pull subdomains from your DNS records, or provide instructions for exporting a list from your DNS provider.

This process is run recursively, so if we discoversub.example.com we'll use that to discover deeper subdomains, such as third.sub.example.com.

Seed Domains

We call the domains you add to discovery seed domains and you can add those from your dashboard or by sending a list or CSV to our team. By default, we use the domain on your email address to seed your account initially.

Add Seed Domains

You can add new seed domains at any time on Discovery › Domain › Add. You'll see a list of suggested domains that are not currently included in your domain discovery.

Remove Seed Domains

You can remove domains from discovery by clicking the ✕ icon next to a domain on Discovery › Domain.

Discovery Process

Each week we'll run our discovery process and compile discovered subdomains. You can also run the discovery process on demand by visiting Discovery › Domain and clicking the refresh icon in the row of the domain you'd like to run the process on.

Discovered Subdomains

All hosts found during the domain discovery process are reflected in the Discovery › Overview report. You can filter discovered targets in the source dropdown to see only ones discovered with domain discovery, or from a specific domain.

For more details on managing discovered domains, see Discovered Targets.