Subdomain Scanner Online — Free Subdomain Scanner Tool

CodexFuse Team · 2026-11-06T07:54:15.159Z · 10 min read min read

Scan any domain in seconds with the free CodexFuse subdomain scanner — find every live subdomain, spot forgotten staging sites, and close the gaps.

A subdomain scanner is a free online tool that checks whether common subdomain names — www, mail, blog, api, dev, staging and more than 100 others — actually resolve for a domain, then lists every one that exists. You type in a domain, the scanner tests each name against live DNS, and within seconds you see the full public face of that domain: the subdomains its owners use, and the ones they forgot about.

That forgotten half is the point. Most businesses know their main website. Very few know every subdomain pointing at their infrastructure, and the ones nobody remembers are exactly the ones attackers probe first.

What is a subdomain scanner?

A subdomain scanner is a lookup tool that discovers the subdomains attached to a domain by testing a wordlist of common subdomain names against DNS and reporting which ones resolve to a live address. It answers one question quickly: what is actually live under this domain right now, including the test sites, old blogs and staging copies that never got switched off?

The CodexFuse Subdomain Scanner checks 100+ common names in one pass — mail, blog, dev, staging, api, shop, support, cdn and many more — and returns a clean list of the ones that resolve. No install, no account needed to try it, and the result arrives in seconds rather than the hours a manual DNS trawl would take.

Why forgotten subdomains are a real security risk

Every subdomain is a door into your infrastructure. The main site usually gets the attention: patched, monitored, backed up. The subdomain created for a three-week campaign in 2023 does not. It sits there running an old CMS version, pointing at a server nobody patches, sometimes still serving a login page with a default password.

Three specific risks keep showing up in real incidents:

• Stale staging and dev copies: staging.example.com often runs the same code as production but without the same hardening. A test login page or an exposed debug endpoint on a dev subdomain can hand an attacker the keys to the production database.
• Subdomain takeover: when a subdomain's DNS record still points at a third-party service that was deleted — a retired hosting account, a cancelled SaaS trial — an attacker can claim that service name and serve their own content under your trusted domain.
• Shadow IT sprawl: marketing spins up shop.example.com, a contractor creates demo.example.com, an agency launches landing.example.com. Nobody owns the list, so nobody notices when one of them starts serving malware or a phishing page.

A regular subdomain scan is the cheapest way to keep that inventory honest. It costs nothing, takes under a minute, and it turns an unknown attack surface into a list you can actually work through.

A worked example: scanning a business domain end to end

Here is a concrete run-through with a fictional business, so you can see exactly what a scan returns and what to do with it.

The scenario

Meridian Legal is a fictional 14-person law firm. Its website is meridian-legal.com. The firm migrated hosting providers eight months ago, and the office manager suspects old subdomains are still pointing at the previous host. Nobody on the team has a list of the firm's subdomains.

The scan

The office manager opens the Subdomain Scanner, types meridian-legal.com into the domain field and runs the scan. The tool tests 112 common subdomain names against live DNS. The whole check takes around 8 seconds and returns 9 live subdomains:

What happened next

Of the 9 subdomains found, 5 were expected and 4 needed action. The firm deleted the DNS records for shop and old, asked its developer to rebuild staging and dev on the current host behind a password, and put intranet behind IP restrictions. Total time from scan to a clean inventory: one afternoon. Without the scan, those four forgotten subdomains would have stayed live indefinitely — two of them pointing at a host the firm no longer paid for or monitored.

How do you run a subdomain scan on CodexFuse?

Running a scan takes three steps: open the Subdomain Scanner, enter the domain you want to check (for example example.com), and read the list of subdomains that resolve. The scanner tests 100+ common subdomain names automatically, so you do not need to know DNS commands or guess which names to try.

Use it on your own domain first, then on any domain you are responsible for — a client's site before a migration, a newly acquired business's web estate, or a competitor's public infrastructure when you are researching how they organise their services. A free CodexFuse account lets you use the tool without limits.

Pair the scan with a nameserver check before any migration: knowing which nameservers answer for a domain tells you where the DNS records live, and that is where you go to delete the stale subdomains your scan just found.

Reading the results: what each subdomain usually means

A scan returns names, not explanations. Here is how to read the common ones:

Anything you cannot explain needs a decision, not a shrug: either it belongs to a live service (document it), or its DNS record should be deleted. "Unknown but harmless" is not a category — an unexplained subdomain is an unmanaged one.

What a subdomain scanner cannot find

Honest limits matter here, because a clean scan result is not a clean bill of health.

• It only tests names on its wordlist: the scanner checks 100+ common names. A subdomain called q3-campaign-2024 or a random string will not appear unless it is on the list. For a complete inventory, the domain owner should also read the DNS zone records directly — those list every subdomain by definition.
• It cannot see private subdomains: internal-only names that do not resolve in public DNS are invisible to any external scanner. Your internal DNS is a separate inventory to maintain.
• It finds names, not vulnerabilities: a scanner tells you staging.example.com exists. It does not tell you whether that staging site has an unpatched plugin or a weak password. That is a job for a security audit, not a lookup.
• It cannot confirm a takeover by itself: if a subdomain points at a deleted third-party service, the scan shows the name resolving — confirming the takeover risk needs a check of where the DNS record actually points, for example with a reverse DNS lookup.

Use the scanner as the first pass: fast, free, and good enough to catch the common problems. Then follow up the flagged names with the deeper checks above.

What to do after your first scan

Turn the results into a short, finished job — not a report that sits in a drawer:

• Build the inventory: save the list of live subdomains in a shared document, with one owner named per subdomain. If no one owns it, it gets deleted.
• Delete the dead records: for every subdomain pointing at a cancelled service or an old host, remove the DNS record at your registrar or DNS provider. Deleting the record is what actually closes the door.
• Lock down dev and staging: anything not meant for the public gets a password, IP allowlist or VPN-only access. A staging site with no login is a public website.
• Check the email angle: mail subdomains and their DNS records affect deliverability. Run a spam score check if your mail subdomain changed hands recently — a stale record can quietly hurt inbox placement.
• Repeat quarterly: set a recurring reminder. Subdomains accumulate silently; a scan every three months keeps the list short and the surprises rare.

Frequently Asked Questions

How do I find all subdomains of a domain?

Enter the domain in a subdomain scanner, which tests common subdomain names against DNS and lists the ones that resolve. For a complete inventory, the domain owner should also check the DNS zone records, which list every subdomain directly.

What is the difference between a subdomain finder and a subdomain scanner?

They do the same job — both discover the subdomains that exist under a domain. Finder and scanner are simply the two names people use for this kind of lookup tool. Our subdomain finder guide covers the same workflow from the discovery angle.

Why would I check a domain's subdomains?

The common reasons are security audits, because forgotten staging or test subdomains are a real attack surface; SEO and migration checks, so no subdomain is left behind when you move hosts; and infrastructure research, to understand how a domain's services are organised.

Is the CodexFuse subdomain scanner free?

Yes, completely free. Sign in to your free CodexFuse account to use it without limits.

Can a subdomain scanner find subdomains that are not on its wordlist?

No. A wordlist scanner only finds names it tests. Unusual or randomly named subdomains will not appear. The DNS zone records held by the domain owner are the only complete source.

Does finding a subdomain mean it is a security problem?

Not on its own. Most subdomains are legitimate services. The problem is the ones nobody owns, monitors or patches. A scan tells you what exists; your job is to decide what each entry is for and whether it should still be live.

Scan your domain now — then close the gaps

Open the Subdomain Scanner, enter your domain, and look at the list with fresh eyes. Delete the DNS records for anything dead, password-protect anything that should never have been public, and write down an owner for everything that remains. That one scan, done today, removes the easiest targets from your domain before anyone else finds them.

And if the scan shows you a sprawling estate — old hosts, scattered email, staging sites nobody owns — stop managing it piece by piece. Move your hosting, business email, security and backups to CodexFuse, where the whole stack is fully managed for you on pay-as-you-go credits. Start at codexfuse.dev, run your scan, and let the managed platform carry the parts you should never have to babysit.