Subfinder — Subdomain Discovery GuideStep-by-step reference: use Subfinder for passive subdomain enumeration — basic, all sources, recursive and bulk. Educational purposes only.FAQ

What is Subfinder?

Subfinder is a fast subdomain discovery tool from ProjectDiscovery. It enumerates valid subdomains of a domain by querying dozens of public passive sources at once, without touching the target directly.

Is Subfinder illegal?

No, it is a legitimate open-source recon tool that only queries public data sources. Using it to enumerate domains you do not own or lack permission to assess is still illegal. Only use it on your own or authorized targets.

What is passive subdomain enumeration?

Passive enumeration collects subdomains from public sources like certificate transparency logs, DNS records and search engines — no direct requests to the target. This is faster and lower-noise than active brute forcing.

How do I run it?

Basic usage is: subfinder -d example.com. Add -all to query every supported source, -recursive for deeper enumeration of discovered subdomains, and -dL to scan a list of domains from a file.

What does the -all flag do?

By default Subfinder uses a curated set of high-signal sources. The -all flag enables every supported passive source, returning the deepest possible collection at the cost of more queries and slower runs.

What is recursive enumeration?

The -recursive flag makes Subfinder re-run enumeration on each discovered subdomain, surfacing deeper levels like api.dev.example.com. This can reveal more of the attack surface.

Can I scan many domains at once?

Yes. Pass a file of domains with -dL domains.txt. Subfinder enumerates each domain in the list and outputs all subdomains.

How do I defend against subdomain discovery?

Audit your subdomains regularly, remove forgotten or stale ones, keep staging and admin subdomains off public records where possible, and monitor for new or unexpected subdomains. Every subdomain is attack surface.

All tools · Sitemap · Games