Who it is for
Use the suite for troubleshooting, migration checks, infrastructure research, and security review.
What you get
Discover subdomains for a domain using various enumeration techniques.
SynchronousBulkRESTMCPSDKInteractive tool
Choose this product when
Choose this product when
Choose this to gather observed public subdomain evidence. A missing name does not prove that no subdomain exists.
What you get
Discover subdomains for a domain using various enumeration techniques.
Endpoints
Review the supported operations, inputs, outputs, execution modes, and response limits before integrating.
Credits and authentication
4-5 Authentication required. Check the operation reference for the exact cost and any per-item pricing.
Example operation
Use documented operations to collect, assess, enrich, verify, compare, protect, or monitor public evidence.
GET
/v1/subdomains
Query Parameters
| Parameter | Type | required |
|---|---|---|
| domain | string | required |
| sources |
string
Allowed values
ct
Default
ct
|
optional |
| verify |
string
Allowed values
truefalse10yesno
Default
false
|
optional |
| include_wildcards |
string
Allowed values
truefalse10yesno
Default
false
|
optional |
| limit |
integer
Default
500
|
optional |
| prefer_cache |
string
Allowed values
truefalse10yesno
Default
false
|
optional |
Response Fields
| Field | Type |
|---|---|
domain |
string |
subdomains[] |
object[] |
subdomains[] |
object |
subdomains[].name |
string |
subdomains[].source |
string |
subdomains[].first_seen |
string | null |
subdomains[].verified |
boolean |
subdomains[].dns_records |
object |
subdomains[].dns_records.A[] |
string[] |
subdomains[].dns_records.CNAME |
string | null |
wildcards[] |
object[] |
wildcards[] |
object |
wildcards[].pattern |
string |
wildcards[].source |
string |
wildcards[].first_seen |
string | null |
summary |
object |
summary.total_found |
integer |
summary.returned |
integer |
summary.verified_count |
integer |
summary.unverified_count |
integer |
summary.sources_used[] |
string[] |
summary.apex_included |
boolean |
summary.wildcard_suppressed_count |
integer |
summary.wildcard_returned_count |
integer |
intelligence_summary |
object |
intelligence_summary.data_sources[] |
string[] |
intelligence_summary.source_count |
integer |
intelligence_summary.cache_status |
string |
intelligence_summary.returned_count |
integer |
intelligence_summary.total_found |
integer |
intelligence_summary.truncated |
boolean |
intelligence_summary.limit |
integer |
intelligence_summary.verification_requested |
boolean |
intelligence_summary.include_wildcards |
boolean |
intelligence_summary.verified_count |
integer |
intelligence_summary.verified_ratio |
number | null |
intelligence_summary.live_dns_record_count |
integer |
intelligence_summary.apex_included |
boolean |
intelligence_summary.wildcard_suppressed_count |
integer |
intelligence_summary.wildcard_returned_count |
integer |
intelligence_summary.first_seen_oldest |
string | null |
intelligence_summary.first_seen_newest |
string | null |
intelligence_summary.warning_count |
integer |
warnings[] |
string[] |
meta |
object |
meta.query_time_ms |
integer |
meta.cached |
boolean |
meta.stale |
boolean |
Example Request
curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/subdomains?domain=example.com&sources=ct&verify=yes&include_wildcards=1&limit=500&prefer_cache=false"Example Response
{
"domain": "example.com",
"subdomains": [
{
"name": "api.example.com",
"source": "crtsh",
"first_seen": "2025-01-15T00:00:00Z",
"verified": true,
"dns_records": {
"A": [
"example"
],
"CNAME": "example"
}
}
],
"summary": {
"total_found": 1,
"returned": 1,
"verified_count": 1,
"unverified_count": 1,
"sources_used": [
"ct"
],
"apex_included": false,
"wildcard_suppressed_count": 1,
"wildcard_returned_count": 1
},
"intelligence_summary": {
"data_sources": [
"ct"
],
"source_count": 1,
"cache_status": "live",
"returned_count": 1,
"total_found": 1,
"truncated": false,
"limit": 1,
"verification_requested": false,
"include_wildcards": false,
"verified_count": 1,
"verified_ratio": 0.5,
"live_dns_record_count": 1,
"apex_included": false,
"wildcard_suppressed_count": 1,
"wildcard_returned_count": 1,
"first_seen_oldest": "example",
"first_seen_newest": "example",
"warning_count": 1
},
"meta": {
"query_time_ms": 1,
"cached": false,
"stale": false
},
"wildcards": [
{
"pattern": "*.example.com",
"source": "ct",
"first_seen": "example"
}
],
"warnings": [
"example"
]
}Limits and evidence boundaries
Coverage is bounded by the documented inputs, budgets, sources, and response limits.
Bulk operations process multiple supported inputs while preserving documented item-level outcomes.
Partial means some requested items or components completed while others did not.
Results describe observed public evidence and its provenance.
Cached indicates that stored evidence was used; review freshness metadata where provided.
Reviewed 2026-08-22
Frequently asked questions
Where can I find the Subdomain Finder request and response reference?
Use the API reference for Subdomain Finder to review parameters, response fields, examples, status codes, and supported operation modes.
How should I interpret unknown or incomplete results from Subdomain Finder?
Unknown or partial results mean that the requested evidence could not be fully determined. Keep the result state, confidence, freshness, and limitations in downstream decisions.
How is Subdomain Finder priced?
Pricing depends on the operation and execution mode. Check the endpoint reference for the current credit cost, authentication requirement, and per-item rules.
