Scans
A scan is the core unit of work in subpoof. You submit a root domain; the platform discovers subdomains attached to it and enriches each with the attributes you asked for.
How discovery works
subpoof uses several discovery techniques in parallel:
- Dictionary probe ("dict probe"): tries common subdomain labels (
www,mail,vpn,autodiscover, ...) against the root and records which ones resolve. The wordlist is your dictionary plus a curated baseline. - Aggregate probe: extends the dict probe with labels seen on other organizations' scans, ranked by historical hit rate.
- TLS certificate enumeration: pulls Subject Alternative Names (SANs) from the certificates served on the root and on already-discovered subdomains. Often surfaces names that no probe would have guessed.
- DNS enrichment: walks SRV, MX, and other record types, harvesting the hostnames they reference.
Each technique runs as a separate "progress trail" inside the scan. You can disable any of them in the scan submit form, but disabling cuts coverage in unpredictable ways and we generally recommend leaving them on unless you have a specific reason.
Per-subdomain enrichments
Once subdomains are discovered, each can be enriched. Enrichments run as parallel queries against the discovered hosts:
| Enrichment | What it tells you |
|---|---|
| DNS records | A/AAAA/CNAME/MX/TXT/SRV resolution, name-server delegation |
| TLS port check | Which TLS ports respond (443, 8443, 465, etc.) |
| TLS cert enum | SANs and issuer for each cert |
| HTTP fingerprint | Server header, framework hints, status codes on common paths |
| Microsoft 365 tenant | Whether the domain is bound to an MS tenant, and which tenant ID |
| NTLM probe | NTLM authentication response signatures (often surfaces internal-AD-style hostnames) |
| RBL check | Whether the host appears on common blocklists |
| Email security | SPF, DKIM, DMARC posture for the domain |
Enrichments are independent. A scan with only DNS enrichment runs much faster than one with the full set.
Scan history
Every scan you run is stored. The dashboard shows recent scans by default; the dictionary page links each label back to the domains where it was found.
Submitting a scan via the API
The same scan submission is available via the /v1/scans endpoint. See the API reference.
Watches feed off scans
If you have a watch on a domain, the daily watch check submits a fresh scan for that domain and diffs the results against the previous run. New labels trigger an alert. See watches.