FINDOMAIN(1) User Commands FINDOMAIN(1) NAME findomain - manual page for findomain 10.0.1 SYNOPSIS findomain [OPTIONS] DESCRIPTION The fastest and cross-platform subdomain enumerator, do not waste your time. OPTIONS -t, --target Target host -r, --resolved Show/write only resolved subdomains -i, --ip Show/write the ip address of resolved subdomains -f, --file Use a list of subdomains writen in a file as input -o, --output Write to an automatically generated output file. The name of the output file is generated using the format: target.txt. If you want a custom output file name, use the -u/--unique-output option -u, --unique-output Write all the results for a target or a list of targets to a specified filename -m, --monitoring-flag Activate Findomain monitoring mode --postgres-user Postgresql username --postgres-password Postgresql password --postgres-host Postgresql host --postgres-port Postgresql port --postgres-database Postgresql database -q, --quiet Remove informative messages but show fatal errors or subdomains not found message --query-database Query the findomain database to search subdomains that have already been discovered --import-subdomains Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import --enable-dot Enable DNS over TLS for resolving subdomains IPs --ipv6-only Perform a IPv6 lookup only --threads Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Deprecated option, use --lighweight-threads instead. This would be removed in the future --lightweight-threads Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Default is 50 --screenshots-threads Number of threads to use to use for taking screenshots. Default is 10 --parallel-ip-ports-scan Number of IPs that will be port-scanned at the same time. Default is 10 --tcp-connect-threads Number of threads to use for TCP connections - It's the equivalent of Nmap's --min-rate. Default is 500 --resolvers Path to a file (or files) containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used --aempty Send alert to webhooks still when no new subdomains have been found -x, --as-resolver Use Findomain as resolver for a list of domains in a file -w, --wordlist Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode --no-wildcards Disable wilcard detection when resolving subdomains --filter Filter subdomains containing specifics strings --exclude Exclude subdomains containing specifics strings --exclude-sources Exclude sources from searching subdomains in [possible values: certspotter, crtsh, sublist3r, facebook, spyse, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer, c99, bufferover_free, bufferover_paid] --http-status Check the HTTP status of subdomains -c, --config Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml --rate-limit Set the rate limit in seconds for each target during enumeration --pscan Enable port scanner --iport Initial port to scan. Default 0 --lport Last port to scan. Default 1000 -v, --verbose Enable verbose mode (useful to debug problems) --mtimeout Allow Findomain to insert data in the database when the webhook returns a timeout error --no-monitor Disable monitoring mode while saving data to database -s, --screenshots Path to save the screenshots of the HTTP(S) website for subdomains with active ones --sandbox Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option -j, --jobname Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option --query-jobname Extract all the subdomains from the database where the job name is the specified using the jobname option --http-timeout Value in seconds for the HTTP Status check of subdomains. Default 5 --tcp-connect-timeout Value in milliseconds to wait for the TCP connection (ip:port) in the ports scanning function. Default 2000 --stdin Read from stdin instead of files or aguments --ua Path to file containing user agents strings --randomize Enable randomization when reading targets from files --no-resolve Disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots --external-subdomains Get external subdomains with amass and subfinder --validate Validate all the subdomains from the specified file --resolver-timeout Timeout in seconds for the resolver. Default 1 --http-retries Number of retries for the HTTP Status check of subdomains. Default 1 --double-dns-check Enable double DNS check. This means that the subdomains that report an IP address are checked again using a list of trustable resolvers to avoid false-positives. Only applies when using custom resolvers -n, --no-discover Prevent findomain from searching subdomains itself. Useful when you are importing subdomains from other tools --max-http-redirects Maximum number of HTTP redirects to follow. Default 0 --reset-database Reset the database. It will delete all the data from the database -h, --help Print help -V, --version Print version SEE ALSO The full documentation for findomain is maintained as a Texinfo manual. If the info and findomain programs are properly installed at your site, the command info findomain should give you access to the complete manual. findomain 10.0.1 July 2025 FINDOMAIN(1)