All toolsAPI
Explore Toyroom

DNS Scout

Inspect DNS records and discover subdomains.

Domains0 domains

TXT records may take longer due to larger response sizes.

DNS records

Inspect the records behind a domain

Choose the record types you need and look up a list of domains. Compare the returned records in one table or export them to CSV.

Addresses
A and AAAA records point to IPv4 and IPv6 addresses.
Mail and nameservers
MX and NS records identify the services behind a domain.
Additional records
Include TXT, CNAME, or SOA when your task calls for them.

About DNS Scout

How do I run a bulk DNS lookup or find subdomains?

DNS Scout resolves DNS records for up to 50,000 domains per run: A, AAAA, MX, and NS by default, plus TXT, CNAME, and SOA when you want them. A second tab finds a domain’s subdomains from passive public sources and checks which ones resolve. Both export to CSV.

How to use it

  1. Paste domains, one per line, and choose record types.
  2. Complete the quick verification. Runs over 10,000 domains switch to export-first mode with a 1,000-row preview.
  3. For subdomains, enter one domain on the Subdomains tab. Live hosts are listed first, with their A and AAAA records.
  4. Export results to CSV.

Data and limits

How it works
Lookups spread across a checked pool of public resolvers, with Google, Cloudflare, and Quad9 as defaults. Subdomain discovery runs subfinder with a 60-second limit.
Limits
50,000 domains per run and 200,000 per day. Subdomain results show up to 100 hosts.
Retention
Bulk result files are deleted after about two hours.
Cost
Free. No account.

Questions

Which DNS records does DNS Scout check?

A, AAAA, MX, and NS are on by default. You can add TXT, CNAME, and SOA.

How does subdomain discovery work?

DNS Scout runs subfinder, which collects subdomains from passive public sources such as certificate logs, then resolves each one to show which hosts are live.

When should I use DNS Scout instead of RDAP Lookup?

Use DNS Scout for anything DNS can answer: whether a name resolves, where it points, and its mail and nameservers. DNS handles large lists. Use RDAP Lookup for registration facts like creation date and registrar, which registries rate-limit.