Getting started
subpoof is a domain intelligence platform. You give it a root domain, it gives you back a thorough catalog of the subdomains attached to that domain, plus the configuration and infrastructure context that turns a list of names into actionable information.
What you do first
- Sign in at https://dashboard.subpoof.com/login using a passkey. New users go through
/signup, which emails you a one-time enrollment link. - From the dashboard, paste a root domain (e.g.
example.com) into the scan box. Submit. - The scan typically completes in a couple of minutes for a small domain, longer for one with hundreds of subdomains. The results page updates as enrichments finish.
What a scan returns
Each scan produces a list of subdomains discovered for the root, plus per-subdomain attributes from any enrichments you enabled: DNS records, TLS certificates, Microsoft 365 tenant identifiers, NTLM probe responses, blocklist status, HTTP server fingerprints, and email-security posture (SPF, DKIM, DMARC). You decide which of those run; the more you enable, the longer the scan and the higher the cost.
Where the data goes
Your scans accumulate. The dashboard's main view shows recent scans, and the dictionary page tracks every subdomain label you have ever discovered across all your scans, deduplicated, ranked by how often each label shows up. Over time the dictionary becomes a private wordlist tuned to the kinds of organizations you scan.
Watches and alerts
If a scan reveals something worth keeping an eye on, set a watch. subpoof checks watched domains daily and alerts you when something new appears.