Skip to content
Deepak Gupta markRecon Atlas

Subdomain discovery

subfinder

Finds subdomains of a domain by querying passive online sources such as certificate logs and DNS datasets.

PassiveScope a pentestAudit your own exposureResearch a competitor

15k stars · last push November 9, 2026 · v2.17.0 · MIT

GitHub repositoryOfficial docs

What it finds

subfinder collects subdomains for a domain from a curated set of passive online sources and never needs to touch the domain's own hosts. It can filter results by match lists or regular expressions, and an optional flag resolves names to keep only live ones.

  • subdomains
  • host IP addresses (with -active)

Does it touch the target?

Reads third-party sources only. Sends no traffic to the target's systems.

README: "subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources... built for doing one thing only - passive subdomain enumeration." The optional -nW/-active flag ("display active subdomains only") adds DNS resolution of found names through resolvers.

API keys: Docs: "Subfinder is available immediately after installation, however the following services require the configuration of API keys to work", stored in $HOME/.config/subfinder/provider-config.yaml.

Install

Install with go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

From the project's documentation

Install with package
brew install subfinder

From the project's documentation

Install with docker
docker pull projectdiscovery/subfinder:latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Enumerate subdomains for one domain
subfinder -d example.com

From the project's documentation

Pipe found subdomains into httpx to find live web servers
echo example.com | subfinder -silent | httpx -silent

From the project's documentation

Keep or drop results with regular expressions
subfinder -d example.com -match-regex '^(api|web)[0-9]{1,3}\.' -filter-regex '(^|\.)dev\.'

From the project's documentation

Run from the Docker image
docker run projectdiscovery/subfinder:latest -d example.com

From the project's documentation

Output formats: jsonl, txt, stdout

Limits the project documents

  • Many sources need API keys before they return results (docs, post install configuration).
  • -all uses every source and the help text marks it as slow.
  • Enumeration stops after -max-time minutes (default 10).

Deepak's take

Analysis, not documentation

Use it when
Reach for it first when you need a quick subdomain list for your domain without sending traffic to its hosts. It pipes cleanly into dnsx or httpx.
Skip it when
Skip it when you need names that never appear in public data. Use a resolver-based brute force with shuffledns or dnsx instead.
What it will miss
It will not find subdomains that no certificate log, archive, or passive DNS source has ever recorded.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: MIT. subfinder is a trademark or project name of its owners; this library is not affiliated with it.