--- name: "findomain" section: "1" platform: "linux" package: "findomain" version: "10.0.1-2" release: "Arch Linux 2026-11-07" platforms: ["linux"] url: "https://carta.tech/man/findomain" --- # findomain(1) manual page for findomain 10.0.1 ## NAME findomain - manual page for findomain 10.0.1 ## SYNOPSIS **findomain** \[*OPTIONS*\] ## DESCRIPTION The fastest and cross-platform subdomain enumerator, do not waste your time. ## OPTIONS - **-t**, **--target** \ Target host - **-r**, **--resolved** Show/write only resolved subdomains - **-i**, **--ip** Show/write the ip address of resolved subdomains - **-f**, **--file** \ Use a list of subdomains writen in a file as input - **-o**, **--output** Write to an automatically generated output file. The name of the output file is generated using the format: target.txt. If you want a custom output file name, use the **-u**/--unique-output option - **-u**, **--unique-output** \ Write all the results for a target or a list of targets to a specified filename - **-m**, **--monitoring-flag** Activate Findomain monitoring mode - **--postgres-user** \ Postgresql username - **--postgres-password** \ Postgresql password - **--postgres-host** \ Postgresql host - **--postgres-port** \ Postgresql port - **--postgres-database** \ Postgresql database - **-q**, **--quiet** Remove informative messages but show fatal errors or subdomains not found message - **--query-database** Query the findomain database to search subdomains that have already been discovered - **--import-subdomains** \ Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import - **--enable-dot** Enable DNS over TLS for resolving subdomains IPs - **--ipv6-only** Perform a IPv6 lookup only - **--threads** \ Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Deprecated option, use **--lighweight-threads** instead. This would be removed in the future - **--lightweight-threads** \ Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Default is 50 - **--screenshots-threads** \ Number of threads to use to use for taking screenshots. Default is 10 - **--parallel-ip-ports-scan** \ Number of IPs that will be port-scanned at the same time. Default is 10 - **--tcp-connect-threads** \ Number of threads to use for TCP connections - It's the equivalent of Nmap's **--min-rate**. Default is 500 - **--resolvers** \ Path to a file (or files) containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used - **--aempty** Send alert to webhooks still when no new subdomains have been found - **-x**, **--as-resolver** Use Findomain as resolver for a list of domains in a file - **-w**, **--wordlist** \ Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode - **--no-wildcards** Disable wilcard detection when resolving subdomains - **--filter** \ Filter subdomains containing specifics strings - **--exclude** \ Exclude subdomains containing specifics strings - **--exclude-sources** \ Exclude sources from searching subdomains in \[possible values: certspotter, crtsh, sublist3r, facebook, spyse, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer, c99, bufferover\_free, bufferover\_paid\] - **--http-status** Check the HTTP status of subdomains - **-c**, **--config** \ Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml - **--rate-limit** \ Set the rate limit in seconds for each target during enumeration - **--pscan** Enable port scanner - **--iport** \ Initial port to scan. Default 0 - **--lport** \ Last port to scan. Default 1000 - **-v**, **--verbose** Enable verbose mode (useful to debug problems) - **--mtimeout** Allow Findomain to insert data in the database when the webhook returns a timeout error - **--no-monitor** Disable monitoring mode while saving data to database - **-s**, **--screenshots** \ Path to save the screenshots of the HTTP(S) website for subdomains with active ones - **--sandbox** Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option - **-j**, **--jobname** \ Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option - **--query-jobname** Extract all the subdomains from the database where the job name is the specified using the jobname option - **--http-timeout** \ Value in seconds for the HTTP Status check of subdomains. Default 5 - **--tcp-connect-timeout** \ Value in milliseconds to wait for the TCP connection (ip:port) in the ports scanning function. Default 2000 - **--stdin** Read from stdin instead of files or aguments - **--ua** \ Path to file containing user agents strings - **--randomize** Enable randomization when reading targets from files - **--no-resolve** Disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots - **--external-subdomains** Get external subdomains with amass and subfinder - **--validate** Validate all the subdomains from the specified file - **--resolver-timeout** \ Timeout in seconds for the resolver. Default 1 - **--http-retries** \ Number of retries for the HTTP Status check of subdomains. Default 1 - **--double-dns-check** Enable double DNS check. This means that the subdomains that report an IP address are checked again using a list of trustable resolvers to avoid false-positives. Only applies when using custom resolvers - **-n**, **--no-discover** Prevent findomain from searching subdomains itself. Useful when you are importing subdomains from other tools - **--max-http-redirects** \ Maximum number of HTTP redirects to follow. Default 0 - **--reset-database** Reset the database. It will delete all the data from the database - **-h**, **--help** Print help - **-V**, **--version** Print version ## SEE ALSO The full documentation for **findomain** is maintained as a Texinfo manual. If the **info** and **findomain** programs are properly installed at your site, the command - **info findomain** should give you access to the complete manual.