CNAME Discovery
Discover hostnames associated with a domain, list any CNAME records in use, and identify likely third-party services linked by those targets.
Results
How discovery works
This tool starts with the root domain and public certificate transparency data to build a candidate hostname set, then checks each hostname for published CNAME records.
Service identification is based on recognizable CNAME target patterns, and the linked-services summary below the table highlights the providers the tool could match confidently.
Coverage limits
Public DNS does not provide a guaranteed way to enumerate every subdomain. Results are best treated as discovered CNAME usage rather than a complete inventory of all hostnames in the zone.
Related Tools
Related Articles
How to Identify a Hosted Service from DNS Clues
Learn how to identify a hosted service or platform from DNS clues such as CNAME targets, MX patterns, TXT records, and provider-specific hostname conventions.
DNS Records Required for Microsoft 365 (Complete Setup Guide)
Complete guide to Microsoft 365 DNS records including MX, SPF, CNAME, DKIM, and DMARC. Includes real record examples and migration best practices.
How Certificate Transparency Helps Find Subdomains
Learn how certificate transparency logs help find subdomains, what the data misses, and how to interpret CT-based hostname discovery safely.