--- name: "findomain" section: "1" platform: "linux" package: "findomain" version: "10.0.1-2" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/findomain" --- # findomain(1) manual page for findomain 10.0.1 ## NAME findomain - manual page for findomain 10.0.1 ## SYNOPSIS **findomain** \[*OPTIONS*\] ## DESCRIPTION The fastest and cross-platform subdomain enumerator, do not waste your time. ## OPTIONS **-t**, **--target** \ - Target host **-r**, **--resolved** - Show/write only resolved subdomains **-i**, **--ip** - Show/write the ip address of resolved subdomains **-f**, **--file** \ - Use a list of subdomains writen in a file as input **-o**, **--output** - Write to an automatically generated output file. The name of the output file is generated using the format: target.txt. If you want a custom output file name, use the **-u**/--unique-output option **-u**, **--unique-output** \ - Write all the results for a target or a list of targets to a specified filename **-m**, **--monitoring-flag** - Activate Findomain monitoring mode **--postgres-user** \ - Postgresql username **--postgres-password** \ - Postgresql password **--postgres-host** \ - Postgresql host **--postgres-port** \ - Postgresql port **--postgres-database** \ - Postgresql database **-q**, **--quiet** - Remove informative messages but show fatal errors or subdomains not found message **--query-database** - Query the findomain database to search subdomains that have already been discovered **--import-subdomains** \ - Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import **--enable-dot** - Enable DNS over TLS for resolving subdomains IPs **--ipv6-only** - Perform a IPv6 lookup only **--threads** \ - Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Deprecated option, use **--lighweight-threads** instead. This would be removed in the future **--lightweight-threads** \ - Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Default is 50 **--screenshots-threads** \ - Number of threads to use to use for taking screenshots. Default is 10 **--parallel-ip-ports-scan** \ - Number of IPs that will be port-scanned at the same time. Default is 10 **--tcp-connect-threads** \ - Number of threads to use for TCP connections - It's the equivalent of Nmap's **--min-rate**. Default is 500 **--resolvers** \ - Path to a file (or files) containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used **--aempty** - Send alert to webhooks still when no new subdomains have been found **-x**, **--as-resolver** - Use Findomain as resolver for a list of domains in a file **-w**, **--wordlist** \ - Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode **--no-wildcards** - Disable wilcard detection when resolving subdomains **--filter** \ - Filter subdomains containing specifics strings **--exclude** \ - Exclude subdomains containing specifics strings **--exclude-sources** \ - Exclude sources from searching subdomains in \[possible values: certspotter, crtsh, sublist3r, facebook, spyse, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer, c99, bufferover\_free, bufferover\_paid\] **--http-status** - Check the HTTP status of subdomains **-c**, **--config** \ - Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml **--rate-limit** \ - Set the rate limit in seconds for each target during enumeration **--pscan** - Enable port scanner **--iport** \ - Initial port to scan. Default 0 **--lport** \ - Last port to scan. Default 1000 **-v**, **--verbose** - Enable verbose mode (useful to debug problems) **--mtimeout** - Allow Findomain to insert data in the database when the webhook returns a timeout error **--no-monitor** - Disable monitoring mode while saving data to database **-s**, **--screenshots** \ - Path to save the screenshots of the HTTP(S) website for subdomains with active ones **--sandbox** - Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option **-j**, **--jobname** \ - Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option **--query-jobname** - Extract all the subdomains from the database where the job name is the specified using the jobname option **--http-timeout** \ - Value in seconds for the HTTP Status check of subdomains. Default 5 **--tcp-connect-timeout** \ - Value in milliseconds to wait for the TCP connection (ip:port) in the ports scanning function. Default 2000 **--stdin** - Read from stdin instead of files or aguments **--ua** \ - Path to file containing user agents strings **--randomize** - Enable randomization when reading targets from files **--no-resolve** - Disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots **--external-subdomains** - Get external subdomains with amass and subfinder **--validate** - Validate all the subdomains from the specified file **--resolver-timeout** \ - Timeout in seconds for the resolver. Default 1 **--http-retries** \ - Number of retries for the HTTP Status check of subdomains. Default 1 **--double-dns-check** - Enable double DNS check. This means that the subdomains that report an IP address are checked again using a list of trustable resolvers to avoid false-positives. Only applies when using custom resolvers **-n**, **--no-discover** - Prevent findomain from searching subdomains itself. Useful when you are importing subdomains from other tools **--max-http-redirects** \ - Maximum number of HTTP redirects to follow. Default 0 **--reset-database** - Reset the database. It will delete all the data from the database **-h**, **--help** - Print help **-V**, **--version** - Print version ## SEE ALSO The full documentation for **findomain** is maintained as a Texinfo manual. If the **info** and **findomain** programs are properly installed at your site, the command - **info findomain** should give you access to the complete manual.