Domains
Subdomain discovery and per-host results
How hosts under a domain are found (certificate logs and DNS), the 100-host limit, and what each host's page shows: status, certificate, ports and findings.
Updated · 2 min read
Most of a domain's attack surface is not on the apex. Subdomain discovery finds the hosts under a domain and watches them from then on.
How hosts are found
Discovery is passive: it reads Certificate Transparency logs for every name ever issued a certificate under the domain, and probes DNS to see which of them resolve. It never sends traffic to the hosts it finds, so it needs no ownership proof and costs no scan allowance. The same public-target rules apply: a domain on the protected list is refused.
- Web: the domain's Subdomains module, and the "find subdomains" picker in the add-domain flow.
- iOS: the Subdomains module on a domain's page. Discovery is on by default in the add sheet.
- API/MCP:
GET /api/domains/:id/subdomains, or the tooldiscover_domain_subdomains.
What is watched
Up to 100 hosts per domain are kept as watched subdomains. On every scan after that:
- each host's certificate is read and listed in the Certificate module soonest-to-expire first;
- the exposure scan covers every watched host as well as the apex (active tools probe the apex plus up to 40 in-scope hosts per run);
- each host is classified Exposed (resolves and answers with findings), Live (resolves) or Gone (no longer resolves), with when it first turned up.
A host's page
Open a host from the Subdomains list for its own findings, its open services with each port named by what the number means, its certificate, and the scan that last touched it. In the app the Vulnerabilities module's Hosts segment lists the same hosts grouped by domain.
Choosing which hosts an active scan covers
When you start an exposure scan you can pass a list of target hosts (the picker in the add flow, or target_hosts on POST /api/vuln-scan/start). The list is capped at 101 entries: the apex plus 100 subdomains. Anything not under the domain is dropped.
Common questions
Discovery found hosts that do not exist any more. Certificate logs are permanent. A name that once had a certificate but no longer resolves is listed as Gone so you know it existed; it is not scanned.
Discovery missed a host. Passive discovery can only see names that appeared in a certificate or resolve in public DNS. A host with a wildcard certificate and no public record is invisible to it. Add it to the target list by hand when you start a scan.
Does this spend anything? No. It is DNS and log reads from the Worker, with no container time and no allowance cost.
Keep reading
Related articles
- Hosts and open portsEvery host a scan found, grouped by domain, with its services named by what the port means; the 128-port list; and why an empty list is not an all-clear.Vulnerabilities and exposure ·Updated
- The certificate reading looks wrongWhy the certificate module can disagree with your host: logs record issuance not presentation, the app's own handshake, auto-renewing issuers, subdomain certs.Troubleshooting ·Updated
- Certificate monitoringWhere certificate data comes from, what the Certificate module shows, subdomain certificates, and the quiet rule for certificates that renew themselves.Domains ·Updated