subfinder
Operator: ProjectDiscovery, Inc.
Locally installable tool that collects subdomains from public sources. Optional DNS resolution and JSONL output.
Technical Infrastructure
Product
Availability and source date
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
Finds additional subdomains for a domain using external sources. Helps collect publicly known hosts associated with an organisation.
Queries
| Input | Result | Result type |
|---|---|---|
| Domain / website | Subdomains found in external sources. Optional source details and active DNS resolution to IP addresses. | Retrieved |
Features
- Collects subdomains from numerous external sources.
- Processes individual domains or domain lists.
- Filters results by patterns and removes duplicates.
- Outputs results as text or JSONL with source details.
- Optionally resolves discovered hosts through active DNS queries.
Categories
- Technical Infrastructure
- DNS
Coverage
Dataset
Access
Installation and deployment
Local command-line program and Go library. The documentation covers pre-built binaries, Go, Homebrew and Docker. Provider API keys are stored in a local configuration file.
Requirements
Export
Provider
Country of establishment
Interfaces
No API, MCP or AI integration is documented.
Maintenance
Licence
Latest activity
Stars
Legal note
Limitations
- Finds only subdomains present in the sources used. Completeness is not guaranteed.
- Many sources require their own API keys and have their own limits.
- Optional active DNS resolution supplements the passive source search.
Guides and practical reports
Official · Installing Subfinder
ProjectDiscovery · EN
Explains installation methods and setting up provider API keys.
External · Recon with Me!!!
DhiyaneshGeek · 02/2020 · EN · Independence unclear
Shows subdomain research and provider keys. Guide from 2020; the installation instructions are outdated.