Exposure Graph: Subdomain and DNS Recon
One domain's public footprint: DNS, mail security, name servers and every subdomain in certificate logs.
No domain mapped yet
Enter a domain to see its findings here.
No domain mapped yet
Enter a domain, or map an example, to draw its public footprint.
Domain at the centre; name servers, MX, mail and DNS checks, IPs and subdomains grouped around it, coloured by finding. Hover for details, click to open the row below, click empty space to reset. Sources: dns.google, crt.sh, Cert Spotter, HackerTarget, Subdomain Center, RDAP and ipwho.is.
Passive: public DNS, certificate logs, RDAP and Hudson Rock. The domain's own servers are never contacted.
Analyst queue
Verified vendors
A verification record shows the company proved it owns the domain to that vendor, usually to set up company accounts. It does not show how widely the product is used.
Subdomains
| Host | Status | Points to | Hosting | Seen in |
|---|
DNS records
DNS records
| Type | Value | Evidence |
|---|
Source status
How the Exposure Graph works
Every lookup runs from your browser against public, keyless sources.
- DNS records: A, AAAA, NS, MX, TXT, CAA and SOA for the domain from dns.google, plus the DMARC, TLS-RPT, MTA-STS and BIMI records and DKIM at ten common selectors. The AD flag on the A answer tells you whether DNSSEC validated.
- Verified vendors: the apex TXT records are matched against over 100 known domain verification formats (OpenAI, Anthropic, Atlassian, Slack, DocuSign, Microsoft 365 and more) and grouped by kind. Unmatched records are listed as they are.
- Registration: creation date, expiry date, registrar and DNSSEC delegation from RDAP, asked of the registry listed in the IANA bootstrap file, with rdap.org as the fallback.
- Subdomains: names from certificate transparency (crt.sh and Cert Spotter) and passive DNS (HackerTarget and Subdomain Center), merged. If a source is rate limited the others still answer. Up to 200 are kept and the first 150 are resolved for A and AAAA records.
- Hosting: a CNAME that ends in a known service (AWS, Azure, Heroku, GitHub Pages, Netlify and over 40 more) names the provider. Otherwise ipwho.is names the network owner, for up to 20 distinct IPs.
- Mail policy: DMARC is parsed tag by tag (p, sp, pct, rua), and SPF include and redirect chains are followed to count DNS lookups against the RFC 7208 limit of 10. A domain with no MX gets the parked-domain check instead: it needs SPF v=spf1 -all and DMARC p=reject (a null MX is optional), or anyone can send mail that shows it as the sender.
- Wildcards: a random name under the domain is looked up; if it answers, live names that give the same answer are marked as wildcard matches.
- Infostealer logs: the Hudson Rock counts from the Stealer Exposure Check are added to the analyst queue.
How to read the result
The headline card counts the red findings in the analyst queue. Red means fix first (a dangling CNAME, a missing SPF or DMARC record, a no-mail domain that can be forged as a sender, staff machines in stealer logs), amber means review, green means the check passed.
- live: the name returns an IPv4 or IPv6 address.
- dangling: the name has a CNAME whose target returns NXDOMAIN. If the target is a hosted service, someone else may be able to claim it.
- CNAME, no IP: the target exists but returns no address. The service may have been retired.
- NXDOMAIN and no answer: the name appeared in an old certificate or in passive DNS and no longer resolves. Useful history, low current risk.
- Risky name: the label contains a word such as admin, vpn, dev, staging, jenkins or webmail. It is a prompt to confirm who owns the host.
Hover a graph node for its details. Click it, or press Enter on it, to highlight its links and open its row below; click empty space to reset. The graph shows up to 26 subdomains on a wide screen and 12 on a phone, riskiest first; the table has all of them.
Exposure Graph FAQ
Where do the subdomains come from?
Four free public sources are merged: crt.sh and Cert Spotter, which read certificate transparency logs, HackerTarget's passive DNS host search, and Subdomain Center, fetched through pwnsy's cache. Free sources limit lookups per IP, so if one is rate limited the others still fill the table. The table keeps up to 200 names, and the first 150 are resolved for A and AAAA records through dns.google.
What does a dangling CNAME mean?
The name points at another name with a CNAME record, and that target no longer exists (the lookup returns NXDOMAIN). If the target sits on a hosted service such as S3, Azure or Heroku, someone else may be able to claim it and serve content on your subdomain. Remove the record or reclaim the target.
Does the tool scan the domain's servers?
No. Every lookup goes to a public resolver or database: dns.google, certificate transparency logs, HackerTarget, Subdomain Center, the registry RDAP service (or rdap.org) and ipwho.is, plus pwnsy's infostealer lookup, which asks Hudson Rock for the domain's counts. The tool never connects to the domain's web servers.
Why does a source show as timed out or failed?
Free sources are often busy, and crt.sh in particular times out. Each source runs on its own, so the other two still fill the graph. Source status at the bottom of the result shows what each one returned.
Can I share a result?
Yes. A lookup puts the domain in the page address, for example pwnsy.com/tools/osint/exposure-graph/example.com, and opening that link runs the same lookup. Copy report gives a plain text summary and JSON downloads every record.
Risk labels are triage prompts for an analyst to verify. Passive lookups only.