DNS search
The DNS search contains all the DNS data ever found by Profundis. You may use it to discover new subdomains, or even as a DNS records history.
How to use it?
Like the hosts search, the easiest way to start is by running the sample query. You can then refine your search by clicking on some of the results and add or exclude them from the search query.
You can use wildcards (*) is almost all fields, e.g. value:*us-east-1.amazonaws.com AND host:"*.domain.com".
Sorting the columns will run a new query and impact your quotas.
How to retrieve all subdomains for a specific domain?
We recommend you use the API or run the subdomain enumeration from the web UI itself.
Which search fields can I use?
| Field name | Description | Examples |
|---|---|---|
host | The hostname. | host:*.example.com AND NOT host:some-sub.*.com |
value | The target DNS value. | host:*.example.com AND value:"*.s3.ap-east-1.amazonaws.com" |
type | The DNS record type (e.g. A, CNAME, NS, etc). | value:"*.pages.dev" and type:CNAME |
How to make my queries faster?
Searching across terabytes of data takes time. To get results faster, we recommend that you filter on a specific domain, e.g. host:"*.domain.tld" and type:CNAME where domain.tld is the domain you are interested in.