Subdomain discovery and per-host results

Most of a domain's attack surface is not on the apex. Subdomain discovery finds the hosts under a domain and watches them from then on.

How hosts are found

Discovery is passive: it reads Certificate Transparency logs for every name ever issued a certificate under the domain, and probes DNS to see which of them resolve. It also looks up about 50 common names (www, mail, api, dev, staging, admin and so on) in DNS, to catch hosts that never had a public certificate; that lookup is skipped when the domain answers every name (wildcard DNS). It never sends traffic to the hosts it finds, so it needs no ownership proof and costs no scan allowance. A domain on the protected list is refused. See Which domains you can scan.

• Web: the "find subdomains" picker in the add-domain flow; the hosts a scan covered are listed under Security, Vulnerability scan.
• iOS: the Subdomains module on a domain's page. Discovery is on by default in the add sheet.
• API/MCP: GET /api/domains/:id/subdomains, or the tool discover_domain_subdomains.

Every day, on its own

On Starter and up, the domain's scheduled scan rediscovers its subdomains: certificate logs every run, and the full DNS check of common names once a day (at most every 20 hours, so an hourly Enterprise account does not repeat it every hour). New hosts that resolve join the watched list and raise a New subdomain alert. Turn it off for one domain with the Subdomains switch on its Daily scan card (subdomain_discovery: false); hosts already found stay watched.

What is watched

Up to 100 hosts per domain are kept as watched subdomains. On every scan after that:

• each host's certificate is read and listed in the Certificate module soonest-to-expire first;
• the exposure scan covers every watched host as well as the apex (active tools probe the apex plus up to 40 in-scope hosts per run);
• each host is classified Exposed (resolves and answers with findings), Live (resolves) or Gone (no longer resolves), with when it first turned up.

New-subdomain alerts

When discovery finds a host under your domain that it has never seen before, you get a "New subdomain" alert in the feed and a push (New subdomains switch, on by default). It says where the name came from (public certificate logs or DNS), and flags a name that looks like a development, admin or internal system. The first discovery after a domain is added is its baseline and raises nothing, a host you added to the watched list yourself is never announced, and a batch of more than three new hosts is one grouped alert.

Subdomains someone else could claim

On Starter and up, the daily discovery pass also checks every host for a subdomain takeover. That's a DNS record still pointing at a hosted service you stopped using, such as a deleted Heroku app, a GitHub Pages site, an S3 bucket or an Azure app, on a service where anyone can sign up and claim the same name. Whoever claims it serves pages on your domain.

We only call it a takeover when both halves are there: the record points at that service, and the service itself says the name is free (the name no longer exists, or the service shows its own "nothing here" page). We look at that page once per host and follow no redirects. A record pointing back into your own domain is never flagged.

When we find one you get a "Subdomain can be taken over" alert and a push, and a change event on the domain that says which record it is and what we saw. You hear about each host once in 30 days, and the event closes itself the first time we find the host fixed. To fix it, delete the DNS record, or set the service back up under the same name. The domain's checkup lists any still open under Attack surface, and an exposure scan runs the same check on the hosts it finds.

A host's page

Open a host from the Subdomains list for its own findings, its open services with each port named by what the number means, its certificate, and the scan that last touched it. In the app the Vulnerabilities module's Hosts list shows the same hosts, and Domains, Software, Advisories, hosts and network targets, Hosts groups them by domain.

Choosing which hosts an active scan covers

When you start an exposure scan you can pass a list of target hosts (the picker in the add flow, or target_hosts on POST /api/vuln-scan/start). The list is capped at 101 entries: the apex plus 100 subdomains. Anything not under the domain is dropped.

Common questions

Discovery found hosts that do not exist any more. Certificate logs are permanent. A name that once had a certificate but no longer resolves is listed as Gone so you know it existed; it is not scanned.

Discovery missed a host. Passive discovery can only see names that appeared in a certificate, or one of the common names it looks up that resolves in public DNS. A host with a wildcard certificate and no public record is invisible to it. Add it to the target list by hand when you start a scan.

Does this spend anything? No. It is DNS and log reads from the Worker, with no container time and no allowance cost.