CNAME Discovery
Discover hostnames associated with a domain, list any CNAME records in use, and identify likely third-party services linked by those targets.
Results
How discovery works
This tool starts with the root domain and public certificate transparency data to build a candidate hostname set, then checks each hostname for published CNAME records.
Service identification is based on recognizable CNAME target patterns, and the linked-services summary below the table highlights the providers the tool could match confidently.
Coverage limits
Public DNS does not provide a guaranteed way to enumerate every subdomain. Results are best treated as discovered CNAME usage rather than a complete inventory of all hostnames in the zone.
Related Tools
Related Articles
How to Identify a Hosted Service from DNS Clues
Learn how to identify a hosted service or platform from DNS clues such as CNAME targets, MX patterns, TXT records, and provider-specific hostname conventions.
Check Certificate SANs And Hostname Coverage
Learn how to check certificate SANs, confirm whether a hostname is covered, and use SAN data to troubleshoot TLS errors and asset exposure.
How Certificate Transparency Helps Find Subdomains
Learn how certificate transparency logs help find subdomains, what the data misses, and how to interpret CT-based hostname discovery safely.