Subdomain discovery
Five passive sources in parallel — certificate transparency, subfinder, assetfinder, findomain and a background amass sweep — merged and deduplicated into a single asset list.
Attack Surface Discovery · Authorised Use Only
Know your attack surface before attackers do.
DomTail continuously maps every subdomain, host, service and exposed port across the domains you own — then tells you precisely what changed since the last scan.
No agent to install on your infrastructure — verify a domain and scan.
7
Pipeline stages
5
Passive sources
1,000+
Ports per sweep
100%
Ownership verified
DNS ownership enforcedEvery domain passes a TXT-record check server-side. The client cannot skip it.
Nothing to installNo agent on your infrastructure. Verify a domain and scan from ours.
Rate-limited by defaultPort discovery is tuned to stay quiet. Turn it off entirely for passive-only policy.
Your data stays exportableFull asset, finding and diff export. No lock-in on the inventory you paid to build.
Capabilities
One pipeline, the whole external surface
Discovery, resolution, probing, port mapping and triage run as a single orchestrated job — so the inventory you get is consistent, not stitched together from six different tools.
DNS + HTTP probing
Every candidate host is resolved, then probed for a live web service. You get status codes, page titles and detected technologies, not just a list of names.
Stealth port scanning
Rate-limited top-ports sweep across the IPs behind your hosts, tuned to stay quiet by default. Disable it entirely if your policy calls for passive-only.
Domain intelligence
On-demand SPF, DKIM, DMARC and BIMI posture, TLS certificate detail, WHOIS records and certificate-transparency history for any domain in your inventory.
Change tracking
Every scan is stored and compared. New subdomains, newly-live hosts, newly-open ports and technology changes surface as a reviewable diff instead of a wall of text.
Triage that matters
Staging and UAT hosts, admin panels, exposed dev tooling, login and upload endpoints, and services on non-standard ports are flagged high-value automatically.
How it works
Verified in minutes, monitored from then on
DomTail will not scan a domain until you have proven you control it. That check is enforced server-side on every single scan request — it is not a client-side courtesy.
Scan lifecycle4 stages · ownership gated
01
Prove ownershipAdd a domain and verify it with a DNS TXT record — or import a whole zone straight from Cloudflare or Route 53.
02
Run a scanThe pipeline enumerates, resolves, probes and — if enabled — port-scans everything under that domain.
03
Review the surfaceAssets, live services, open ports and findings land in one inventory you can filter, sort and export.
04
Watch for driftRe-scan on your schedule. DomTail reports only what actually changed since the previous run.
Plans
Scoped to the size of your estate
Start free on a handful of domains. Larger plans are provisioned by our team — get in touch and we will size one to your environment.
Free
Kick the tyres on a couple of domains you own.
- 3 domains
- 5 scans / month
- Subdomain + DNS + HTTP discovery
- Domain intelligence
- Port scanning
- Change tracking
Basic
For a small estate that needs regular coverage.
- 10 domains
- 20 scans / month
- Everything in Free
- Full asset inventory + findings
- Port scanning
- Change tracking
Most popular
Pro
The full pipeline, including active port discovery.
- 50 domains
- 100 scans / month
- Everything in Basic
- Stealth port scanning
- Change tracking between scans
- API tokens + webhooks
Enterprise
Unlimited scope, for teams running this at estate scale.
- Unlimited domains
- Unlimited scans
- Everything in Pro
- Self-hosted scan agent
- Full data export
- Priority support
Authorised use only
DomTail performs real reconnaissance, including active port scanning. It is built for organisations mapping their own estate, or for testers working under explicit written authorisation.
Every domain must pass DNS ownership verification before it can be scanned, and that check cannot be bypassed from the client. Scanning infrastructure you do not own or have permission to test is prohibited — and in most jurisdictions, illegal.
Ready?
Map your surface today
Add a domain, verify it with a TXT record, and run your first scan in a few minutes. Nothing to install on your own infrastructure.