Subfinder — Install, Use, Optimise (2026)

ProjectDiscovery's passive subdomain enumeration tool — fast, JSON-native, designed to chain into other tools.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

Go install

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Docker

docker run projectdiscovery/subfinder -d target.com

Binary release

curl -L https://github.com/projectdiscovery/subfinder/releases/latest/download/subfinder_linux_amd64.zip -o sf.zip && unzip sf.zip

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Single domain

subfinder -d target.com

Multiple domains, JSON

subfinder -dL domains.txt -oJ -o subs.json

All sources (slower)

subfinder -d target.com -all

Recursive (sub-of-sub-of-sub)

subfinder -d target.com -recursive

Pipe to httpx for live check

subfinder -d target.com -silent | httpx -silent

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• Default uses ~10 free passive sources. -all activates 30+ but adds API rate-limits.
• API keys in ~/.config/subfinder/provider-config.yaml for SecurityTrails, BinaryEdge, Shodan etc. unlock more data.
• -t 100 raises concurrency from default 10 — useful for -dL bulk scans.
• -silent disables banner output — required when piping into httpx, dnsx, nuclei.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Subfinder is passive only — won’t find subdomains that aren’t indexed somewhere. Always pair with amass enum -active -brute for full coverage.
• -recursive can run for hours on common TLDs. Use -timeout 30 to bound it.
• Default rate-limit per source is conservative; commercial scanning with high volumes may need API keys to avoid throttling.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• amass — more sources but slower.
• assetfinder — even simpler.
• chaos — ProjectDiscovery’s subdomain DB lookup CLI.

India context and engagement notes

Standard recon kickoff: subfinder -d X | dnsx | httpx | nuclei. This is THE bug-bounty hunter pipeline in 2026.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.