How to Get Alerted When a New Subdomain Appears

Attack surfaces rarely grow on purpose. A marketing subdomain gets spun up for a campaign and outlives it by two years. A developer stands up staging.example.comto test something once and never tears it down. Someone adds a wildcard DNS record to make a demo easier and forgets it's there. None of these show up in any inventory - they just quietly exist, reachable from the public internet, until something (or someone) finds them.

The DIY approach: subfinder or amass, on a schedule

This is one of the more approachable things to automate yourself. Tools like subfinder and amassenumerate subdomains from public sources (certificate transparency logs, DNS records, search indexes) in seconds. Run one on a cron schedule, save the list, diff it against yesterday's list, and mail yourself anything new:

• subfinder -d example.com -silent to get the current list.
• Diff it against the previous run's output.
• Mail yourself anything that's new.

This is genuinely solid, and it's not a coincidence it looks familiar - our own scanner uses subfinderunder the hood too, for the same reason: it's a good tool for the job.

Where a bare subdomain list runs out of road

• A new name on its own isn't the interesting part.What matters is what's running on it - is there an open port, a web service, a certificate? A list of hostnames doesn't answer that; you're back to scanning each new name separately.
• No memory of "we looked at this already."A name that's intentional (that campaign microsite, on purpose) shows up in every future diff exactly the same as a genuinely new one, unless you maintain your own exclusion list by hand.
• Doesn't scale across domains.Running and maintaining this per domain gets old fast once you're responsible for more than a couple.

How SurfaceDiff handles it

Subdomain discovery is one part of the same full snapshot SurfaceDiff builds on every scheduled scan - alongside DNS records, open ports, TLS certificates, and live web services for that domain. A new subdomain becomes an ASSETfinding in the same diff as everything else, so you see it together with whatever else showed up alongside it, not as an isolated hostname with no context. Mark it reviewed once - with a reason, if it's an intentional one like that campaign site - and it stops re-appearing as something to investigate, while still being tracked.

Run a free scan to see what subdomains and services turn up on a domain you manage.