What is subfinder and is it safe to run?

subfinder is an open-source command-line tool from ProjectDiscovery that discovers subdomains by querying passive sources — Certificate Transparency feeds, DNS datasets, search engines and threat-intelligence APIs — and merging the results. In its default passive mode it sends no traffic to the target domain, only to those third-party sources, which makes it safe and legal to run for any domain you are entitled to research. Adding free API keys for services such as Censys, Shodan or SecurityTrails substantially improves coverage. Follow-up steps that contact the discovered hosts, such as probing them with httpx, should be limited to domains you own or are authorised to test.

subfinder vs amass — which is better?

They overlap on passive sources and differ in ambition. subfinder is fast, simple and passive-only: one command, a clean list, ideal for routine inventory and pipelines. amass, an OWASP flagship project, adds active techniques — DNS brute-forcing with wordlists, name permutations, zone walking — and stores everything in a graph database that records relationships between names, addresses and networks, which makes it slower but more complete and better for mapping a large or unfamiliar estate. A common practice is subfinder for the monthly baseline and amass in active mode for a deeper quarterly pass on domains you own; both are free and open source.

Can I find subdomains without installing anything?

Yes. Certificate Transparency search sites such as crt.sh list every name that ever had a public certificate under a domain, which is typically the largest single source, and search engines with a site: query add names that were linked from somewhere. Web-based finders combine a CT query with DNS lookups so you also learn which names are live, which point at third-party platforms, which are dangling and which are gone — MySecScan's Subdomain Finder does this passively and for free. What a browser tool cannot do is active discovery or probing of the hosts, so for a complete inventory of your own domain, add your DNS zone export and a command-line run of subfinder or amass.

Subdomain Enumeration Tools — subfinder, amass, crt.sh, dnsx Compared

The subdomain enumeration tools worth knowing in 2026 are a short list: subfinder and amass for aggregated passive discovery, crt.sh and Cert Spotter as the raw Certificate Transparency source, dnsx/httpx to resolve and probe what you found, and browser tools like ours for a no-install first pass. Which you use depends on whether you own the domain and how complete the list must be.

Which subdomain enumeration tool should you use?

Tool	Type	Sources	Needs	Best for
subfinder	CLI, passive	~40 APIs and CT feeds; more with free API keys	Go binary, optional keys	Fast, broad passive coverage of domains you own
amass	CLI, passive + active	Same class of sources plus DNS brute-force, permutations, graph DB	Go binary, patience	Maximum coverage and asset graphs; slower
crt.sh / Cert Spotter	Web / API, passive	Certificate Transparency only	A browser or curl	The single richest source; the raw feed the aggregators read
dnsx + httpx	CLI, resolve / probe	Your list	Go binaries; httpx contacts hosts — own domains only	Turning a name list into live hosts with titles and status codes
dnstwist	CLI, lookalike generator	Permutations + DNS/WHOIS	Python	Not subdomains — lookalike domains for phishing watch
MySecScan Subdomain Finder	Web, passive	CT (crt.sh → Cert Spotter) + DNS classification	Nothing	A no-install first pass with live / third-party / dangling labels and owner explanations

How do you use subfinder?

subfinder by ProjectDiscovery is the de-facto standard for passive enumeration: one binary, dozens of sources, output ready to pipe. It does not brute-force and does not touch the target by default, which makes it safe for reconnaissance you are entitled to do.

# Install (Go 1.21+), or download a release binary
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Passive enumeration, all sources, quiet output
subfinder -d example.com -all -silent -o subs.txt

# Add free API keys (Censys, Shodan, VirusTotal, SecurityTrails …) for far better coverage
#   ~/.config/subfinder/provider-config.yaml
# Then resolve + probe what you found — ONLY for domains you own:
cat subs.txt | dnsx -silent -a -cname -resp | tee resolved.txt
cat subs.txt | httpx -silent -status-code -title -tech-detect

Two habits: run with -all (the default source set is the fast subset), and diff successive runs — new names are new assets.

When is amass the better choice?

When you need everything and can wait. amass enum -passive covers roughly the same passive sources; amass enum -active -brute adds DNS brute-forcing with wordlists, name permutations (dev-api, api2) and zone-walking, and stores results in a graph database you can query later for relationships between names, IPs and ASNs. It is an OWASP flagship project. Active mode is only for your own domains; it generates real DNS load.

amass enum -passive -d example.com -o amass-passive.txt
amass enum -active -brute -d example.com -o amass-active.txt      # own domains only

What does a complete pipeline look like?

Collect — subfinder (or amass passive) + a direct crt.sh pull, merged and de-duplicated.
Classify — dnsx (or plain dig): live, CNAME, dangling, unresolved. Dangling CNAMEs go straight to the takeover check.
Probe (own domains) — httpx for status, title and tech; feed the live list to the Website Security Score or nuclei.
Record — one table, owner per row, kept in version control; see the mapping template.
Repeat monthly and on every launch; alert on the diff.

Common gotcha: counting tools by the number of subdomains they return. Passive aggregators include stale history — names that resolved in 2021 — and active brute-forcers include wildcard-DNS noise where every random name “exists”. The number that matters is the classified one: how many resolve today, and to what.

For the site owner and for the developer

For the site owner (plain English)

You do not need to install anything to get the first useful answer. A web-based passive finder shows every name in your domain's certificate history and whether each one is live, points at an outside service, is broken, or is gone — enough to ask your team the right questions. The command-line tools are for whoever maintains your infrastructure, when they need the complete picture of a domain they own.

Start with the no-install pass: every subdomain in your certificate history, classified by DNS, with the dangling ones flagged.

Try the Subdomain Finder →

For the developer / IT

Baseline = subfinder -all with a provider config, merged with crt.sh, classified with dnsx, diffed in CI monthly. Reserve amass active mode and httpx probing for domains you own, run them from an IP you can identify, and keep the wordlists modest — the goal is inventory, not load testing your own resolver. For lookalike domains (a different problem) use dnstwist against CT and RDAP, or let the Domain Monitor run that sweep daily.

Subdomain Enumeration Tools: subfinder, amass, crt.sh, dnsx — Which to Use and How