Subdomain Discovery

What this check runs

This check enumerates your subdomains the way a Fierce scan would, combining DNS queries, brute-forced common names and other discovery techniques to build a list of the subdomains that exist under your domain. It is answering a question most teams cannot answer from memory: what is actually out there under our name.

Why it matters

Organisations accumulate subdomains: staging environments, old marketing microsites, tools spun up for one project, services pointed at third parties and forgotten. Each is part of your attack surface, and the forgotten ones are the most dangerous because nobody is watching them, patching them, or checking whether their DNS records still point somewhere you control.

Discovery matters because you cannot secure what you do not know exists. A staging site with debug mode on, an old app version with a since-patched vulnerability, or a subdomain pointing at a decommissioned service, are all found by the same enumeration an attacker runs, and all are yours to answer for.

What the findings mean

Findings list the subdomains discovered. The value is the inventory itself: each one is something to account for, secure, or retire, and any pointing at unclaimed third-party resources are takeover risks.

The remedy is maintaining an inventory of subdomains, securing or decommissioning the forgotten ones, and cleaning up DNS records for anything retired, which also closes the takeover risk covered in the subdomain takeover guide.

See the step-by-step remediation: how to fix this.