# Subdomain Finder & Scanner – Find All Subdomains of a Domain (`rowfeed/subdomain-finder`) Actor

Find subdomains of any domain from certificate logs, passive DNS and the Internet Archive, merged into one list, with a live DNS check and IP addresses. Bulk domains. $0.50 per 1,000 subdomains, domains with none are free.

- **URL**: https://apify.com/rowfeed/subdomain-finder.md
- **Developed by:** [Rowfeed](https://apify.com/rowfeed) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.50 / 1,000 subdomains

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Subdomain Finder & Scanner – Find All Subdomains of a Domain

Find the subdomains of any domain, in bulk, as one clean list. The Actor asks four public sources at the same time and merges their answers, then checks which subdomains are live today.

Built for security reviews of your own domains, IT and SEO audits, competitor research and AI agents that need a domain's footprint.

### Why four sources

Single sources go down often. In our tests crt.sh answered 502 or timed out on some calls and the Internet Archive answered 503 on others. This Actor uses:

- **crt.sh** and **Cert Spotter**: names on public TLS certificates
- **HackerTarget**: passive DNS records
- **Internet Archive**: host names of archived pages

If some sources are down, you still get what the others found, and the run's status message names the ones that missed. A later run may then find more. Every row says which sources saw that name.

### Example output row

```json
{
  "domain": "apify.com",
  "subdomain": "console.apify.com",
  "resolves": true,
  "ips": ["104.18.0.1"],
  "sources": ["crt.sh", "Cert Spotter", "HackerTarget"],
  "sources_found": 3,
  "checked_at": "2026-11-06T10:00:00Z"
}
```

`resolves` is `true` when the name has an IPv4 or IPv6 address today, `false` when it has none (it may be gone, or used only for mail or similar), and `null` when the check could not tell. `ips` lists the addresses.

### Input

| Field | What it does |
| --- | --- |
| `domains` | Domains to look up, up to 500 per run. A full link also works. |
| `maxSubdomainsPerDomain` | Caps very large domains. Default 1,000, maximum 20,000. |
| `checkDns` | Checks each name and lists its IP addresses. On by default and included in the price. |
| `onlyLive` | Delivers only names that resolve today. Old names are dropped and not charged. |

### Pricing

Pay per event, no subscription:

- **$0.50 per 1,000 subdomains** ($0.0005 each).
- $0.001 per run start.

A domain with 50 subdomains costs about $0.03. A domain with no subdomains, or that could not be checked, costs nothing beyond the start. You can cap a run with the maximum charge setting and it stops cleanly there.

**The pre-filled example** runs live. If all sources are down at that moment, it answers from a saved real result instead (rows carry `from_snapshot: true`).

### Good to know

- These are public, passive sources. The Actor does not scan or brute-force anything, and it never contacts the target's own servers. DNS checks go through Cloudflare's public resolver.
- The free sources limit how often they answer, so the number of subdomains can differ between runs. You only pay for what is delivered.
- No list like this is complete: a subdomain that never had a public certificate or an archived page will not show up.
- Certificates also list old names, so some subdomains no longer exist. Use `onlyLive` to keep the working ones.
- Very large domains can stop at Cert Spotter's free page limit; the other sources still count.
- Use it on domains you own or may lawfully research.

### More tools from Rowfeed

- [WHOIS Lookup & DNS Checker](https://apify.com/rowfeed/domain-rdap-checker) – domain age, expiry, DNS, SSL and an SPF/DMARC grade.
- [Website Technology Checker](https://apify.com/rowfeed/website-technology-checker) – CMS, analytics and hosting of any website.
- [Website Email Extractor & Contact Finder](https://apify.com/rowfeed/website-contact-finder) – company emails and phones from websites.

# Actor input Schema

## `domains` (type: `array`):

The domains to look up, up to 500 per run, e.g. example.com. A full link also works.

## `maxSubdomainsPerDomain` (type: `integer`):

Caps the cost of very large domains. Each subdomain delivered is one charge.

## `checkDns` (type: `boolean`):

Check whether each subdomain resolves today and list its IP addresses. Included in the price.

## `onlyLive` (type: `boolean`):

Deliver only subdomains that resolve today. Old names from certificates are dropped, not charged. Needs the DNS check.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "example.org"
  ],
  "maxSubdomainsPerDomain": 1000,
  "checkDns": true,
  "onlyLive": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("rowfeed/subdomain-finder").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": ["apify.com"] }

# Run the Actor and wait for it to finish
run = client.actor("rowfeed/subdomain-finder").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com"
  ]
}' |
apify call rowfeed/subdomain-finder --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,rowfeed/subdomain-finder"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/MPHmVADbWbMi4eS27/builds/Elpkb9ygqO5uR6EHs/openapi.json