hostnag

Discovery and takeover

Every name under a domain, found in its own DNS, its homepage and the names people usually use, each judged live, gone or pointing nowhere, with the ones anyone could claim listed first.

Start freeSee pricing

Included on every plan.

PlansFreeProBusiness
Sources
DNS records, the homepage, 179 common names
Names
up to 200 per discovery
Per day
3 discoveries on Free, 10 on Pro and Business
Connections
DNS lookups and one fetch of the homepage; a GET to a live name only when its CNAME passes a provider with a known unclaimed page
In public
the free subdomain finder: names and whether each answers, 5 a day per visitor

What Discover finds

A discovery of a sample domain as Tools shows it: the takeover first, then the live names.

8 hosts found under acme.example. From its DNS records (1), its website (3) and common names (4).

Takeover risk

  • promo.acme.example

    promo.acme.example points at acme-promo.herokuapp.com, which no longer exists at Heroku. Anyone can claim that name and serve content on promo.acme.example. Remove the CNAME or reclaim the name.

Live

  • acme.exampleWatched
  • api.acme.exampleWatched
  • mail.acme.example
  • shop.acme.exampleWatched
  • status.acme.example
  • vpn.acme.example
  • www.acme.exampleWatched

Save this to an assessment to turn its hosts into checks.

How it works

  1. 01

    Name a domain

    Discover on a zone page, or in Tools, takes a registrable domain like example.com and looks under it.

  2. 02

    Three sources at once

    The domain's own records (nameservers, mail servers, the hosts its SPF and DMARC name, the usual service records), the names its homepage mentions, and 179 names people commonly use, one DNS lookup each. A domain that answers for any name at all is spotted first, so a wildcard never fills the list.

  3. 03

    Each name judged

    Live, gone, or pointing at something that no longer exists. A name whose CNAME leads to a provider where the target is unclaimed is a takeover risk (9 providers, among them Amazon S3, GitHub Pages, Heroku and Azure); a CNAME that leads nowhere else is dangling, a stale record to remove.

  4. 04

    Watch what is worth watching

    The result marks what you already watch, lists every takeover risk first, and offers a website and a certificate monitor for each live name you do not watch, plus the domain itself when nothing watches it yet, all created in one step.

Questions

Does Discover touch my servers?

Barely. It reads DNS through hostnag's own resolver and fetches the homepage once. The only other request is one GET to a live name whose CNAME passes through a provider with a known unclaimed page, to read that page.

What is a subdomain takeover?

A name like promo.example.com still points, by CNAME, at a service you stopped using: a deleted Heroku app, an S3 bucket, a GitHub Pages site. Whoever creates that app or bucket again gets to serve pages, and often read cookies, on your name. The fix is to remove the record or reclaim the name.

Will I be told when a new one appears?

Not on its own today. Discover runs when you ask, from a zone page or in Tools, where an assessment can run it again for a before and after.

Is the free subdomain finder the same thing?

The same lookup, showing only the names and whether each answers. Takeover findings, CNAME chains and addresses stay behind sign-in.

Related

Tools and assessmentsAny check run once from one address box, and a client review or an audit kept as an assessment: your notes and verdicts, run again for a before and after, printed, shared or exported.DNS monitoringThe records that point people and mail at your systems, watched for drift from the answer you told hostnag to expect.Certificate monitoringEvery certificate hostnag can reach is watched for expiry, a swapped chain and a renewal that should already have happened; the ones it cannot reach get a URL to report to instead.Free subdomain finderThe names under a domain and whether each answers, no sign-in.

Add a host. Hear about it first.

Start free