Find DNS Host Records | Subdomain Finder | (2024)

Find all Forward DNS (A) records for a domain. Enter a domain name and search for all subdomains associated with that domain. A handy reconnaissance tool when assessing an organisations security.

Valid Input

Recon: Find your targets with a DNS (A) record search

Use this hostname search to find all the forward DNS records (A recrds) for an organisation. A number of limits apply to FREE users including number of results and number of daily queries. Remove limits with a Membership or try the Domain profiler tool to get a full listing with additional meta data from the discovered hosts.

A forward DNS record (or A record) is used to determine an IP address from a human readable hostname. By searching all forward DNS records for a domain, attackers (or security penetration testers) can begin to understand the layout of an organisations Internet footprint. This type of reconnaissance can discover a wide range of hosts from multiple IP net blocks that can contain a wide range of services. With a good understanding of the perimeter the discovered systems can be assessed for security weak spots. The more hosts found the wider the potential attack surface.

Subdomain Enumeration Limits

Membership FREE USER
Queries / day# based on Plan50
Max # of Results500'000500
Data Set UpdatesHourlyWeekly

With a membership get up to half a million results from a single query. A gold mine of data for security analysts, network defenders and other cyber security professionals.

Updates to the DNS Data set are applied regularly from multiple sources. With a membership access newly discovered subdomains every hour.

Find DNS Host Records | Subdomain Finder | (1)

Forward DNS Hostname Search

The only function within the DNS protocol to identify all (A) records associated with a domain is to perform a DNS Zone Transfer. This zone transfer is a process that allows replication of DNS data between two DNS servers. However, it is deemed to be a security risk to leak all that DNS data so a properly configured DNS server should not allow a DNS zone transfer to non-authorized hosts.

Since it is likely that a DNS zone transfer will not work, we need another way to identify all the hosts associated with a domain. This discovery process can use a number of resources such as search engines, DNS data sets, brute forcing or crawling to enumerate subdomains.

Subdomain Enumeration from Search Engines

Search engines are a popular subdomain enumeration technique. Advantages of this method are that it is a passive search, in other words you are not sending any traffic to the target network or DNS servers. The search engine returns a list of results that contain the domain you are searching on. An example using Google is to perform the following query:

This will show all results from Google that contain the domain As it is likely that there are many results on we can refine the search with the following query.

This will filter the domain from the results, perhaps revealing a number of more interesting subdomains to target.

Brute Forcing Subdomains

A number of DNS enumeration tools and scripts are available that will simply take a list of keywords (potential subdomains) and attempt to resolve these against the target domain. This is not an entirely passive undertaking as the DNS resolution goes to the target domains DNS server and results in many failed lookups.

If someone is closely monitoring the DNS server of the target domain they will be able to detect that someone is performing a brute force subdomain scan against the domain.

There are a number of tools that can perform this enumeration, if you have Nmap installed there is an NSE script that will perform a DNS subdomain brute force (dns-brute).

DNS and SSL Data Sets for Subdomain Enumeration

Find DNS Host Records | Subdomain Finder | (2)The data we use to find host records here at is sourced from a number of excellent projects as well as Internet search engines. is a project supported by Rapid 7 that compiles Internet scan data as well as DNS data sets, including both forward and reverse DNS records. By searching through the Forward DNS data set we can find all subdomains in the list that match a domain name query.

Another project is the project. This project from the University of Michigan also compiles a large amount of Internet scan data as well SSL data. Searching the SSL records can reveal host names of target domains. There is an API available or the full data sets can be downloaded.

Certificate transparency logs are yet another excellent source of host data. A project that allows browsers to confirm the validity of SSL certificates in near real time. Certificate transparency also happens to be an excellent source for performing reconnaissance against target domains.

Related IP Tools

We have a number of other related tools in our IP Tools suite that may be of interest. The Reverse DNS Lookup enables searching reverse PTR records for a domain and the Reverse IP search identifies hosts sharing an IP address. By combining these tools it should be possible to get a very good indication of where an organisations Internet systems are located both from IP address and physical location if used in conjunction with GeoIP lookups.

Domain Profiler for Attack Surface Discovery

Find DNS Host Records | Subdomain Finder | (3)

Use the Domain Profiler tool to perform automated reconnaissance against a domain name. This provides a quick overview of an organisations Internet facing infrastructure within a few minutes.

Results are collected passively; no packets are sent against the target IP ranges resulting in a very stealthy way to assess an organizations perimeter.

Learn More

Scan Membership

Forward DNS search API

Rather than using the form above you can also access the forward DNS tool using the API. The output is simply plain text and will include the IP address and the forward DNS host name. Data from the tool can be easily imported into a spreadsheet or other tool for reference purposes.

This query will display the forward DNS records discovered using the data sets outlined above.

The API is simple to use and aims to be a quick reference tool; like all our IP Tools there is a limit of 50 queries per day. Remove limits with a Full Membership.

For those who need to send more packets upgrade to Enterprise Plans.

Automated Security Vulnerability Scans.

Discover. Investigate. Learn.

Use Cases

Website Recon?

Fingerprint Web App
Technologies in Bulk

Whatweb / Wappalyzer

Remove limits with a full membership

More info available


Find DNS Host Records | Subdomain Finder | (2024)


How do I find out where my DNS records are hosted? ›

Find the DNS host

Go to and search for your domain. In the search results, the section labeled Name Servers shows the location of your DNS host.

How do I look up a DNS record? ›

The most efficient way to check DNS records of the domain is to use a terminal with the command nslookup. This command will run on almost all operating systems (Windows, Linux, and macOS).

How do I get a list of DNS records? ›

Using nslookup online is very simple. Enter a domain name in the search bar above and hit 'enter'. This will take you to an overview of DNS records for the domain name you specified. Behind the scenes, will query a DNS server for DNS records without caching the results.

How do I trace a DNS lookup command? ›

Access your command prompt. Use the command nslookup (this stands for Name Server Lookup) followed by the domain name or IP address you want to trace. Press enter. This command will simply query the Name Service for information about the specified IP address or domain name.

Can I see my DNS history? ›

Type cmd in the Start menu search bar to open Command Prompt. Then click Run as administrator. Enter the command ipconfig/displaydns and hit Enter. You'll see your detailed DNS cache history.

How do I view DNS logs? ›

To view the log location of the DNS server:
  1. Open Server Manager and from the Tools menu, select DNS server management application.
  2. From the left-pane, expand DNS and select a protocol (for example, IPv4).
  3. Right-click IPv4 and then select Properties.
  4. In the Properties dialog box, select the Debug Logging tab.
Jun 1, 2023

What command is used to lookup DNS records? ›

Type nslookup and hit Enter. The displayed information will be your local DNS server and its IP address. You can specify the DNS server (IP address), type of record, and domain name.

How to do a DNS lookup? ›

1. Using Windows command line
  1. Open the command prompt.
  2. Type nslookup followed by the IP address and press 'Enter. ' For example, it can be nslookup 8.8. 8.8.
  3. Now, the command prompt will return the DNS name and the IP you entered.
May 22, 2024

How do I download all DNS records for a domain? ›

How to Export Multiple DNS Records in DNS Made Easy
  1. Navigate to Managed DNS. After logging in to the DNS Made Easy dashboard, select Managed DNS from the DNS menu at the top of the page.
  2. Select the Domain You Want to Export Records For. ...
  3. Navigate to Reporting. ...
  4. Select File Type and Export.
Oct 21, 2023

How do I open DNS lookup? ›

For Windows:
  1. Open Command Prompt.
  2. Enter nslookup to perform a DNS lookup for the domain.

How do I check my DNS activity? ›

To view DNS activity details: In the in the Threat Protection menu of Enterprise Center, select Reports > DNS Activity.

Where are DNS lookups stored? ›

Each time a user performs a DNS lookup, its device will first check inside the internal DNS cache that is part of the OS. There is a table of DNS records inside the DNS cache, their values, and the time they could be kept (TTL).

How do I know where my DNS is coming from? ›

You can run command nslookup -d2 domain name (for example: nslookup to check the process of resolution in detail including DNS client queries which DNS server.

Where are DNS host files located? ›

In Windows 10 the hosts file is located at c:\Windows\System32\Drivers\etc\hosts.

Where is the DNS server hosted? ›

The DNS directory isn't located in one physical place or even one corner of the vast Internet. It's distributed all over the world and stored on many different servers that communicate with one another to regularly provide updates, information, and redundancies.

Where is the DNS database location? ›

All of these files are located in the %SystemRoot%\system32\Dns directory, and all except the dummy boot file are built from standard resource records. A name server boot file points to sources of DNS information.


Top Articles
Latest Posts
Article information

Author: Greg O'Connell

Last Updated:

Views: 5956

Rating: 4.1 / 5 (62 voted)

Reviews: 85% of readers found this page helpful

Author information

Name: Greg O'Connell

Birthday: 1992-01-10

Address: Suite 517 2436 Jefferey Pass, Shanitaside, UT 27519

Phone: +2614651609714

Job: Education Developer

Hobby: Cooking, Gambling, Pottery, Shooting, Baseball, Singing, Snowboarding

Introduction: My name is Greg O'Connell, I am a delightful, colorful, talented, kind, lively, modern, tender person who loves writing and wants to share my knowledge and understanding with you.