Search

Find Subdomains from DNS records

DNS RecordsSubdomain

Have DNS records? These OSINT tools take DNS records as input and return subdomains. 6 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

6tools
All DNS Records tools
Recon-ng icon

Recon-ng

Modular web reconnaissance framework

FreeOSSCLI
IN+5
OUT+1
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
DNSDumpster icon

DNSDumpster

Passive DNS and subdomain reconnaissance

FreeWeb
IN
OUT
DNSReaper icon

DNSReaper

Subdomain takeover detection scanner

FreeOSSWebCLI
IN
OUT
Subfinder icon

Subfinder

a passive subdomain discovery tool that queries many public data sources

FreeOSSCLI
IN
OUT
Sublist3r icon

Sublist3r

Enumerate subdomains from public sources

FreeOSSCLI
IN
OUT

Find subdomain from other data

Domain Name63IP Address12Company Name10Email Address5WHOIS Data5
All OSINT use cases & data types