Subdomain & DNS Discovery
How RiskShelter finds all subdomains associated with your domain and what it tells you about each one.
Subdomains are one of the most common blind spots in perimeter security. Staging environments, forgotten microservices, and old partner integrations often remain exposed long after they're needed.
How discovery works
RiskShelter combines several passive and active techniques:
Certificate Transparency logs record every SSL certificate ever issued for a domain and its subdomains (these logs are public and RiskShelter queries them automatically). Passive DNS sources cross-reference historical resolution data without touching your nameservers. DNS brute-forcing resolves a curated wordlist of common hostnames against your domain to catch anything the passive sources missed.
What shows up in the Subdomains tab
Each discovered hostname appears with its IP address (including ASN and geolocation), DNS record type, HTTP status code, CDN or cloud provider, and SSL certificate status. The search bar and filter dropdowns let you slice by status, CDN, record type, or IP range.
Dangling CNAMEs
When a CNAME points to a third-party service (a cloud provider, SaaS tool, hosting platform) that has since been deleted or decommissioned, that subdomain is at risk of takeover: someone else can claim the orphaned resource and serve content under your domain. RiskShelter detects these and flags them so you can fix the DNS record before it becomes a problem.
History view
Each subdomain keeps a full change history: when it was first seen, when its IP changed, when it went offline. This makes it easy to spot whether something newly discovered was an intentional deployment or an accidental exposure.