运维和安全排查要枚举子域 DNS 记录：dig 一次查一个，拼字典脚本效率低，商用探测平台不给原始记录。
可以做成什么
能做成什么
dig + 子域枚举一体的 CLI：字典 + 证书透明度日志聚合，输出结构化 JSON；开源核心 + API 收费。
怎么验证它
读完原帖的评论区，把重复出现的具体场景记下来——重复次数就是需求的密度。
搜索「DNS / 运维工具」相关的现有工具，确认它们只覆盖了哪一环。
用一句话落地页，投回 Stack Exchange 或同类社群，看有没有人主动问价格。
已有方案与差异
amass/subfinder（枚举强但无 DNS 细节）；dig（不枚举）
社区原声 · 热门评论
For almost all domains not under your control, the problem in your request is here: without supplying nor even knowing the names of all these subdomains If the server is not yours, you can only count on using a DNS request to communicate with it. The DNS query which might list which subdomains exist under a given domain is AXFR, and you can use dig for that: $ dig axfr example.org @ns.example.org but on almost all servers this is disabled for unauthorized users. I looked over Wikipedia's List of DNS record types and found no other request types which would involve information on subdomains whe
ChatGPT suggested that the crt.sh web service from Sectigo could help find many or most of the public subdomains of a given domain. I tried it out, and it does indeed seem to work, though it took some playing with and won't give you everything for some sites. Additionally, it allows you to download results as CSV or JSON, which is useful for processing with tools. So with some caveats (explained below), for many sites you can accomplish this with a small workflow: 1. crt.sh The crt.sh website allows you to search a list of their records of certificates, such as are used for HTTPS. This should
社区原声 · 热门评论
打开原帖核对