How to Install and Use Subfinder in Linux for Passive Subdomain Discovery and Reconnaissance

In modern cybersecurity reconnaissance and attack surface management, identifying an organization’s full digital perimeter is the foundational first step. Subdomains frequently host legacy administrative panels, internal staging APIs, unpatched test environments, and development portals that are overlooked during standard audits. However, actively probing DNS servers through brute-force wordlists can trigger rate-limiting, alert intrusion detection systems (IDS), and strain network infrastructure. Subfinder, developed by ProjectDiscovery, solves this by specializing in fast, passive subdomain enumeration.

Rather than sending active DNS queries directly to target nameservers, Subfinder queries dozens of passive public datasets—including Certificate Transparency logs, search engine caches, DNS aggregators, and threat intelligence feeds—to discover valid subdomains without generating direct network traffic to the target.

Why Passive Enumeration Matters

Passive discovery provides critical advantages over active brute-forcing:

• Undetectable Footprint: Because Subfinder queries public third-party APIs (such as Censys, Shodan, VirusTotal, and SecurityTrails), the target’s firewall and intrusion detection systems observe zero scan traffic.
• Blazing Performance: Built with Go goroutines, Subfinder queries dozens of upstream sources in parallel, compiling thousands of unique subdomains in seconds.
• Complementary to Active Scanning: Output streams cleanly via standard Unix pipes (stdout), allowing seamless chaining into active resolution tools like dnsx or vulnerability scanners like nuclei.

Installing Subfinder on Linux

You can install Subfinder via pre-compiled binaries or by building directly from source using the Go compiler:

# Method 1: Download Official Pre-compiled Binary (Recommended)
curl -s https://api.github.com/repos/projectdiscovery/subfinder/releases/latest | grep "browser_download_url.*linux_amd64.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf subfinder_*_linux_amd64.tar.gz
sudo mv subfinder /usr/local/bin/
subfinder -version

# Method 2: Via Go (Requires Go 1.21+)
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Configuring API Keys for Maximum Coverage

While Subfinder functions effectively out of the box using free, unauthenticated public sources, adding free API keys significantly expands results. Subfinder creates a configuration file located at ~/.config/subfinder/provider-config.yaml upon first execution.

To enable premium and authenticated services (e.g., GitHub, SecurityTrails, Chaos, Shodan), edit the configuration file:

nano ~/.config/subfinder/provider-config.yaml

Populate your free API keys under the respective service headings, then save the file.

Essential Command Flags

The table below summarizes common command-line flags used with Subfinder:

Flag	Description	Usage Example
-d <domain>	Target domain to enumerate	subfinder -d example.com
-dL <file>	Text file containing list of target domains	subfinder -dL domains.txt
-all	Query all configured sources (slower, exhaustive)	subfinder -d example.com -all
-silent	Display only discovered subdomains (suppress banner)	subfinder -d example.com -silent
-o <file>	Write output to text file	subfinder -d example.com -o subs.txt
-oJ	Write output formatted as JSON objects	subfinder -d example.com -oJ -o subs.json

Running Subdomain Enumeration Scans

1. Basic Passive Scan

To run a standard passive discovery scan against a target domain:

subfinder -d example.com -o example_subdomains.txt

2. Silent Mode for Unix Pipeline Automation

When chaining Subfinder into secondary reconnaissance tools, pass the -silent flag to output clean text lines without ASCII banners:

subfinder -d example.com -silent | httpx -title -status-code

In this workflow, discovered subdomains are immediately probed for live web servers displaying HTTP response status codes and page titles.

3. Exhaustive Discovery with All Sources

To force Subfinder to query every available passive data provider regardless of latency thresholds:

subfinder -d example.com -all -recursive -o full_recon.txt

Frequently Asked Questions

Does Subfinder verify if discovered subdomains are currently active?

No. By design, Subfinder performs strictly passive discovery from historic and current records. Some returned subdomains may no longer resolve. To filter for active hosts, pipe the output into a resolver tool such as dnsx: subfinder -d example.com -silent | dnsx -silent.

Is running Subfinder legal against targets I do not own?

Yes. Subfinder queries publicly accessible datasets and open Certificate Transparency logs. It transmits zero network packets to the target domain itself, making passive enumeration completely non-intrusive.