Skip to content
Utilora

Browser-Native Subdomain Scanner

Zero-Trust Utilities

Privacy Shield: Subdomains are resolved completely in your browser by querying public DNS-over-HTTPS endpoints (Cloudflare/Google). No scanning traffic or target domains are ever sent to Utilora servers.

Tracking this target over time?

This page gives you subdomain enumeration right now. The Recon Workspace saves each scan and shows you what changed since the last one — a new subdomain, a weakened DMARC policy — with the same browser-only guarantee.

What is Browser-Native Subdomain Scanner?

Browser-Native Subdomain Scanner is a reconnaissance tool designed for developers, penetration testers, and security researchers to discover subdomains of a target domain. Active subdomain scanning usually requires sending lists to a server or running terminal tools. This tool brings that capability directly to the browser, querying DNS-over-HTTPS APIs to check if subdomains exist. Because it runs client-side, your target domains remain completely confidential, preventing leaks to third-party web scanners.

How it works

The scanner takes the target domain and prepends a list of common subdomains (e.g. vpn, admin, mail). It then resolves each host (e.g. vpn.example.com) by firing parallel, rate-controlled JSON fetch requests to Cloudflare or Google's DNS-over-HTTPS APIs. If the DNS query returns an A or AAAA record with IP addresses, the subdomain is marked as active. If it returns NXDOMAIN, the subdomain is inactive.

Features & Benefits

  • 100% Private: Scan targets never touch any utility servers; queries go direct to public DoH providers
  • Concurrent Scanning: Fast, throttled client-side resolution avoids browser rate limits and hangs
  • CSV/JSON Export: Save discovered subdomains along with their IP resolutions instantly
  • Offline Ready: The scanner code and default wordlist load once and run entirely on your local machine

Frequently Asked Questions

Is this scanner as fast as command line tools?

Because it is subject to browser fetch connection limits and CORS, it is designed for targeted discovery (using 50-200 common names) rather than brute-forcing millions of combinations.

Why does it use DNS-over-HTTPS instead of native socket connection?

Web browsers cannot make raw UDP/TCP DNS queries. DoH allows us to query DNS records via standard secure HTTP fetch requests.

Can I use custom wordlists?

Yes, you can edit the list of subdomains in the options section before launching the scan.

Related Tools

DNS & SPF/DMARC Security Inspector

Analyze DNS records (MX, SPF, DMARC, TXT) to identify email spoofing risks and domain security configurations privately in your browser.

Autofill Exposure Auditor - Test Your Browser

Test if your browser autofill is leaking hidden data to websites. Interactive simulation of the 'hidden field' attack.

Popular Utilities

JSON Formatter & Validator

Format, validate, and minify JSON instantly in your browser. Your data never leaves your device.

JWT Decoder

Decode JWT tokens and inspect header and payload instantly in your browser. Your tokens never leave your device.

Word Counter

Count words, characters, sentences, and estimate reading time instantly in your browser. No sign-up required.

Learn More & Guides

Real DNS From a Browser Tab: DoH, CORS, and What You Genuinely Cannot Scan

A browser can resolve real DNS records, brute-force subdomains, and audit mail security without a server. It cannot scan a port. Here is exactly where the line sits, and why.

5 min read

SPF, DMARC, and the Grades Nobody Checks

A domain with an SPF record can be completely unprotected against spoofing. Two records is worse than one. And p=none, the most common DMARC policy in the wild, blocks nothing at all.

5 min read

What Changed Since Tuesday: Recon as a Longitudinal Job

A one-shot scan answers the wrong question. The finding that matters is not which subdomains exist, it is which one appeared last week. That requires storing scans, and getting one field exactly right.

5 min read

Username Sweeps and the Rate-Limit Trap

Checking one handle across eight platforms is easy. The bug worth avoiding is treating every failed request as proof the account does not exist, which is how OSINT tools quietly lie to you.

5 min read