# findomain: fast passive subdomain enumeration

> How to install and run findomain, and why Tandera runs three passive subdomain producers instead of one.

`findomain` is a passive subdomain enumerator written in Rust. It queries certificate transparency logs and a set of public APIs and returns hostnames. Functionally it overlaps with `subfinder`; the reason to run both is that their source lists differ.

## Install

```bash
# binary release
curl -LO https://github.com/Findomain/Findomain/releases/latest/download/findomain-linux.zip
unzip findomain-linux.zip && chmod +x findomain && sudo mv findomain /usr/local/bin/

# from source
cargo install --git https://github.com/Findomain/Findomain
```

## Core commands

```bash
# a single target
findomain -t example.com -q

# from a file of roots
findomain -f roots.txt -q -u subs.txt

# resolve as it goes
findomain -t example.com -r -q

# only hosts that respond over HTTP
findomain -t example.com -i -q
```

`-q` is quiet mode: hostnames only, no banner, pipes cleanly.

## Output

Plain hostnames, one per line. With `-r`, the resolved address is appended.

## Where it sits in Tandera

findomain runs in **discovery** on `recon_web_lite` and `recon_web_full`, alongside `subfinder` and `cero`.

Three producers is a deliberate choice. Passive sources are incomplete in different ways: certificate transparency sees anything that was ever issued a certificate, passive DNS sees what was resolved, and search-based sources see what was linked. Tandera merges the three and deduplicates, because the union is consistently larger than the best single source.

## Using it in a pentest

**Do not treat overlap as waste.** If findomain returns nothing subfinder missed on one engagement, it will on the next. The cost is seconds; the cost of missing a host is the finding you did not make.

**Resolve before you report.** `-r` gives you resolution inline, but the pipeline discipline is the same as always: passive output is a claim until DNS confirms it.

**Rate limits are real.** The free API tiers throttle. On a large root list, findomain will silently return less than it could. Check the count against your other producers and rerun if one looks anomalously thin.

---

Canonical: https://tandera.io/tools/findomain
This page as markdown: https://tandera.io/tools/findomain.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.