Specify a list of subdomains to check for

dnsmap

  • The dnsmap command scans a domain for common subdomains e.g. smtp.domain.org.
    More information: <https://github.com/resurrecting-open-source-projects/dnsmap>.
  • Trick copyright: tl;dr; <https://github.com/tldr-pages/tldr>

dnsmap {{example.com}} -w {{path/to/wordlist.txt}}

click the source code to copy install dnsmap on any operating system with command-not-found.com