Does subfinder's -t flag work without -active?

No. -t sets the number of concurrent goroutines for resolving, and resolving only runs in -active mode. Without -active, subfinder pulls from passive sources and -t has no effect. Combine -active with -t to speed up live-name resolution.

Does subfinder touch the target?

Not in the default passive mode. It queries public sources like certificate transparency logs and DNS aggregators, so it maps a footprint without sending traffic to the subdomains. -active then resolves the names, which does contact DNS.

How do I find which subdomains are live?

Pass subfinder's output to httpx, which probes each name and reports what responds, its status code, title, and tech. In a Trickest workflow, wire the subfinder node into an httpx node.

How do I get the widest coverage?

Use -all to query every configured source (slower), and add API keys via -provider-config for sources like SecurityTrails, Shodan, and VirusTotal that return more results when authenticated.

Updated Jul 14, 2026

Recon

Enumerate a domain's subdomains from passive sources

A subdomain discovery tool that finds valid subdomains using passive online sources.

Map an organization's footprint Feed a probing and scanning pipeline Monitor for new subdomains

overview

What subfinder does

subfinder enumerates a domain's subdomains by querying passive sources such as certificate transparency logs, DNS aggregators, and threat-intelligence feeds, rather than brute forcing names. That makes it fast and quiet: it builds a broad map of an organization's footprint without sending traffic to the targets themselves.

Its modular architecture is built for one job and does it well. Pull from all sources for maximum coverage or a chosen few for speed, set per-provider rate limits, and emit JSONL so every result is a structured record. Active mode resolves the names and reports only the subdomains that are live.

On Trickest, subfinder is a Recon node that takes a domain or a list of domains and writes a file and a folder of names. It is the usual first node in an attack-surface workflow; pass its output to httpx to find which subdomains respond, and schedule it for continuous monitoring.

source github.com/projectdiscovery/subfinder

use cases

Where subfinder fits

Map an organization's footprint

Enumerate every subdomain of a domain from passive sources to scope an engagement or build an asset inventory.

Feed a probing and scanning pipeline

Hand discovered subdomains to httpx and a scanner so the rest of the workflow runs against the full surface.

Monitor for new subdomains

Run subfinder on a schedule and diff results to catch newly exposed assets as they go live.

Enumerate many domains at once

Supply a file of domains for bulk discovery and write the combined name list for downstream nodes.

reference

subfinder inputs and flags

30 inputs

Name	Type	Flag	Description
domain	STRING	-domain	Domains to find subdomains for (comma-separated).
list	FILE	-list	File containing a list of domains for bulk discovery.
json	BOOLEAN	-json	Write output in JSONL format.
all	BOOLEAN	-all	Use all sources for enumeration (slow).
active	BOOLEAN	-active	Display active subdomains only.
match	STRING	-match	Subdomain or list of subdomains to match (comma-separated).
rate-limit	STRING	-rate-limit	Maximum HTTP requests to send per second (global).
sources	STRING	-sources	Specific sources to use for discovery (-s crtsh,github).

Showing key inputs. subfinder exposes 30 inputs in total.

Full flag reference (30 inputs)

Name	Type	Flag	Description
ip	BOOLEAN	-ip	include host IP in output (-active only)
all	BOOLEAN	-all	use all sources for enumeration (slow)
json	BOOLEAN	-json	write output in JSONL(ines) format
list	FILE	-list	file containing list of domains for subdomain discovery
match	STRING	-match	subdomain or list of subdomain to match (comma separated)
proxy	STRING	-proxy	http proxy to use with subfinder
stats	BOOLEAN	-stats	report source statistics
active	BOOLEAN	-active	display active subdomains only
config	FILE	-config	flag config file
domain	STRING	-domain	domains to find subdomains for (comma separated)
filter	STRING	-filter	subdomain or list of subdomain to filter (comma separated)
silent	BOOLEAN	-silent	show only subdomains in output
sources	STRING	-sources	specific sources to use for discovery (-s crtsh,github).
threads	STRING	-t	number of concurrent goroutines for resolving (-active only) (default 10)
timeout	STRING	-timeout	seconds to wait before timing out (default 30)
verbose	BOOLEAN	-v	show verbose output
max-time	STRING	-max-time	minutes to wait for enumeration results (default 10)
no-color	BOOLEAN	-no-color	disable color in output
recursive	BOOLEAN	-recursive	use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)
resolvers	STRING	-r	comma separated list of resolvers to use
exclude-ip	BOOLEAN	-exclude-ip	exclude IPs from the list of domains
match-file	FILE	-match	subdomain or list of subdomain to match
rate-limit	STRING	-rate-limit	maximum number of http requests to send per second (global)
filter-file	FILE	-filter	subdomain or list of subdomain to filter
rate-limits	STRING	-rate-limits	maximum number of http requests to send per second four providers in key=value format (-rls hackertarget=10/m) (default ["github=30/m", "fullhunt=60/m", "robtex=18446744073709551615/ms", "securitytrails=1/s", "shodan=1/s", "virustotal=4/m", "hackertarget=2/s", "waybackarchive=15/m", "whoisxmlapi=50/s"])
resolvers-list	FILE	-rlist	file containing list of resolvers to use
collect-sources	BOOLEAN	-collect-sources	include all sources in the output (-json only)
exclude-sources	STRING	-exclude-sources	sources to exclude from enumeration (-es alienvault,zoomeyeapi)
provider-config	FILE	-provider-config	provider config file
disable-update-check	BOOLEAN	-disable-update-check	disable automatic subfinder update check

example

Run subfinder

subfinder · command

# passive enumeration across all sources, quiet outputsubfinder -d example.com -all -silent -o subdomains.txt

sample output

api.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comgrafana.example.comhive-api.dev.example.comwww.staging.example.com…  (53 hosts found for the real run behind this page)

guidance

Choosing subfinder

Use subfinder for fast, passive subdomain discovery at the start of a workflow. For active DNS brute forcing of a wordlist, pair it with subbrute. It finds names, it does not test them, so follow it with httpx to learn which subdomains are live.

amass

Deeper, slower OSINT with active options. subfinder is quicker for a passive first pass.

assetfinder

Lighter passive finder. subfinder queries more sources for broader coverage.

faq

subfinder questions

Pass the domain with -d, e.g. `subfinder -d example.com`. Add -silent to print only the subdomains and -o to write them to a file. On Trickest, set the node's domain input instead of the flag.

Run subfinder yourself

A domain feeds subfinder, which enumerates subdomains passively and passes them to httpx so only live names land as output.

Run subfinder in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

domain

STRING

-domain

Domains to find subdomains for (comma-separated).

list

FILE

-list

File containing a list of domains for bulk discovery.

json

BOOLEAN

-json

Write output in JSONL format.

all

BOOLEAN

-all

Use all sources for enumeration (slow).

active

BOOLEAN

-active

Display active subdomains only.

match

STRING

-match

Subdomain or list of subdomains to match (comma-separated).

rate-limit

STRING

-rate-limit

Maximum HTTP requests to send per second (global).

sources

STRING

-sources

Specific sources to use for discovery (-s crtsh,github).

Name

Type

Flag

Description

BOOLEAN

-ip

include host IP in output (-active only)

all

BOOLEAN

-all

use all sources for enumeration (slow)

json

BOOLEAN

-json

write output in JSONL(ines) format

list

FILE

-list

file containing list of domains for subdomain discovery

match

STRING

-match

subdomain or list of subdomain to match (comma separated)

proxy

STRING

-proxy

http proxy to use with subfinder

stats

BOOLEAN

-stats

report source statistics

active

BOOLEAN

-active

display active subdomains only

config

FILE

-config

flag config file

domain

STRING

-domain

domains to find subdomains for (comma separated)

filter

STRING

-filter

subdomain or list of subdomain to filter (comma separated)

silent

BOOLEAN

-silent

show only subdomains in output

sources

STRING

-sources

specific sources to use for discovery (-s crtsh,github).

threads

STRING

-t

number of concurrent goroutines for resolving (-active only) (default 10)

timeout

STRING

-timeout

seconds to wait before timing out (default 30)

verbose

BOOLEAN

-v

show verbose output

max-time

STRING

-max-time

minutes to wait for enumeration results (default 10)

no-color

BOOLEAN

-no-color

disable color in output

recursive

BOOLEAN

-recursive

use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)

resolvers

STRING

-r

comma separated list of resolvers to use

exclude-ip

BOOLEAN

-exclude-ip

exclude IPs from the list of domains

match-file

FILE

-match

subdomain or list of subdomain to match

rate-limit

STRING

-rate-limit

maximum number of http requests to send per second (global)

filter-file

FILE

-filter

subdomain or list of subdomain to filter

rate-limits

STRING

-rate-limits

maximum number of http requests to send per second four providers in key=value format (-rls hackertarget=10/m) (default ["github=30/m", "fullhunt=60/m", "robtex=18446744073709551615/ms", "securitytrails=1/s", "shodan=1/s", "virustotal=4/m", "hackertarget=2/s", "waybackarchive=15/m", "whoisxmlapi=50/s"])

resolvers-list

FILE

-rlist

file containing list of resolvers to use

collect-sources

BOOLEAN

-collect-sources

include all sources in the output (-json only)

exclude-sources

STRING

-exclude-sources

sources to exclude from enumeration (-es alienvault,zoomeyeapi)

provider-config

FILE

-provider-config

provider config file

disable-update-check

BOOLEAN

-disable-update-check

disable automatic subfinder update check

api.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comgrafana.example.comhive-api.dev.example.comwww.staging.example.com… (53 hosts found for the real run behind this page)

Enumerate a domain's subdomains from passive sources

What subfinder does

Where subfinder fits

Map an organization's footprint

Feed a probing and scanning pipeline

Monitor for new subdomains

Enumerate many domains at once

subfinder inputs and flags

Run subfinder

Choosing subfinder

amass

assetfinder

subfinder questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run subfinder yourself

Enumerate a domain's subdomains from passive sources

What subfinder does

Where subfinder fits

Map an organization's footprint

Feed a probing and scanning pipeline

Monitor for new subdomains

Enumerate many domains at once

subfinder inputs and flags

Run subfinder

Choosing subfinder

amass

assetfinder

subfinder questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run subfinder yourself