search_subdomains
Discover subdomains associated with a domain to identify potential security vulnerabilities and expand network reconnaissance during cybersecurity assessments.
Instructions
Search for subdomains of a given domain.
Args: domain: The parent domain name to query (e.g., example.com) ctx: Request context page: Page number for pagination (Plus accounts only)
Returns: Formatted string containing subdomains found
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | ||
| page | No |
Implementation Reference
- server.py:562-647 (handler)The main handler function for the 'search_subdomains' tool. It validates the domain, uses the DNSDumpsterClient to fetch DNS records, extracts subdomains from A and CNAME records, formats the output, and handles pagination and errors.async def search_subdomains(domain: str, ctx: Context, page: int = 1) -> str: """Search for subdomains of a given domain. Args: domain: The parent domain name to query (e.g., example.com) ctx: Request context page: Page number for pagination (Plus accounts only) Returns: Formatted string containing subdomains found """ if not domain: return "Error: Domain is required" # Validate domain if not is_valid_domain(domain): return "Error: Invalid domain name format" try: api_key = os.environ.get("DNSDUMPSTER_API_KEY") if not api_key: return "Error: API key not configured. Set DNSDUMPSTER_API_KEY environment variable." client = DNSDumpsterClient(api_key) try: ctx.info(f"Searching subdomains for {domain} (page {page})") result = await client.get_dns_records(domain, page=page) # Extract subdomains from A records subdomains = set() if "a" in result: for record in result["a"]: host = record.get("host", "").lower() if ( host and host.endswith(domain.lower()) and host != domain.lower() ): subdomains.add(host) # Extract subdomains from CNAME records if "cname" in result: for record in result["cname"]: host = record.get("host", "").lower() if ( host and host.endswith(domain.lower()) and host != domain.lower() ): subdomains.add(host) target = record.get("target", "").lower() if ( target and target.endswith(domain.lower()) and target != domain.lower() ): subdomains.add(target) if not subdomains: return f"No subdomains found for {domain} on page {page}" output_lines = [f"Subdomains for {domain} (page {page}):"] for subdomain in sorted(subdomains): output_lines.append(f"\n{subdomain}") # Add pagination hint total_records = result.get("total_a_recs", 0) if total_records > 50 and len(subdomains) >= 50: # Free tier limit output_lines.append( f"\n\nShowing {len(subdomains)} subdomains. There may be more results available." ) output_lines.append( f"To see more results, use page parameter (e.g., page=2)" ) return "\n".join(output_lines) finally: await client.close() except Exception as e: return f"Error: {str(e)}"