Subdomain Enumeration: Finding the Attack Surface You Forgot You Own

The perimeter of a modern organisation is not its firewall — it is its DNS zone. Every subdomain someone spun up in 2021 and never decommissioned is still live, still resolving, and still part of your attack surface. Subdomain enumeration is the discipline of listing all of them before an attacker does.

Why forgotten subdomains are dangerous

Three patterns account for most incidents:

• Dangling CNAMEs: blog.example.com points to example.github.io or example.herokuapp.com. The project was deleted, the CNAME stayed. Anyone can now claim that name on the platform and serve content on your hostname — with your cookies, your CORS origin, your brand. That is subdomain takeover, and it is fully attacker-controllable.
• Staging and admin panels: dev.example.com or old-api.example.com running an unpatched copy of the application with debug mode on and weaker auth. Attackers scan exactly these names because they expect them to be neglected.
• Certificate and scope surprises: a wildcard certificate or a broad CORS policy covers the forgotten host too, so compromising it can expose credentials valid on production.

Passive discovery methods

Passive enumeration never sends traffic to the target’s own infrastructure, which makes it safe and fast:

• Certificate transparency logs: every publicly trusted certificate is logged at crt.sh and similar monitors. Searching %.example.com reveals subdomains that were ever issued a certificate — including internal-looking ones someone mistakenly signed with Let’s Encrypt.
• Search engines and archives: site:*.example.com queries and Wayback snapshots surface hosts that existed but no longer resolve usefully.
• DNS datasets: services that index zone data (VirusTotal, SecurityTrails, PassiveDNS) record historical resolutions, which is how you find hosts that were live last year and matter for takeover analysis.
• Third-party references: public repositories, mobile app configs and JS bundles often contain API hostnames nobody documented.
• DNS sweep of adjacent names: teams name things predictably — api, staging, dev, old, test, vpn. A short dictionary of such prefixes checked against DNS catches hosts no log ever mentioned.

Active confirmation is then a narrow step — resolving each candidate and checking whether it answers. Candidates worth checking first are the ones leaked by certificates, docs and code:

dig +short blog.example.com
dig +short dev.example.com
dig +short old-api.example.com

What to do with the list

1. Resolve every name; anything pointing at a third-party platform (GitHub Pages, Heroku, Azure, S3, Shopify) deserves a takeover check against that platform’s claim rules.
2. Tie every live host to an owner and a purpose. A subdomain nobody can explain is the deliverable of this exercise.
3. Repeat periodically. Enumeration is a snapshot; new subdomains appear every sprint.

The subdomain discovery tool on WhoDNS combines certificate-transparency sources with DNS probing to produce that list for any domain, flagging which names resolve and which hang — a dangling record in that output is the highest-value finding you can get from five minutes of work.