In the

Domain Name System The Domain Name System (DNS) is a hierarchical and distributed name service that provides a naming system for computers, services, and other resources on the Internet or other Internet Protocol (IP) networks. It associates various information ...

(DNS) hierarchy, a subdomain is a domain that is a part of another (main) domain. For example, if a domain offered an online store as part of their website it might use the subdomain.

Overview

The

(DNS) has a

tree structure A tree structure, tree diagram, or tree model is a way of representing the hierarchical nature of a structure in a graphical form. It is named a "tree structure" because the classic representation resembles a tree, although the chart is gen ...

or hierarchy, which includes nodes on the tree being a

domain name In the Internet, a domain name is a string that identifies a realm of administrative autonomy, authority, or control. Domain names are often used to identify services provided through the Internet, such as websites, email services, and more. ...

. A subdomain is a domain that is part of a larger domain. Each label may contain from 0 to 63

octets Octet may refer to: Music * Octet (music), ensemble consisting of eight instruments or voices, or composition written for such an ensemble ** String octet, a piece of music written for eight string instruments *** Octet (Mendelssohn), 1825 compos ...

.RFC 1034, ''Domain Names - Concepts and Facilities'', P. Mockapetris (Nov 1987) The full domain name may not exceed a total length of 253 ASCII characters in its textual representation.RFC 1035, ''Domain names--Implementation and specification'', P. Mockapetris (Nov 1987) Subdomains are defined by editing the DNS zone file pertaining to the parent domain. However, there is an ongoing debate over the use of the term "subdomain" when referring to names which map to the Address record A (host) and various other types of zone records which may map to any public

IP address An Internet Protocol address (IP address) is a numerical label such as that is assigned to a device connected to a computer network that uses the Internet Protocol for communication. IP addresses serve two main functions: network interface i ...

destination and any type of server. Network Operations teams insist that it is inappropriate to use the term "subdomain" to refer to any mapping other than that provided by zone NS (name server) records and any server-destination other than that. According to RFC 1034, ''"a domain is a subdomain of another domain if it is contained within that domain"''. Based on that definition, a host cannot be a subdomain, only a domain can be a subdomain. A subdomain will also have a separate zone file with a SOA record (Start of Authority). Most domain registries only allocate a two-level domain name. Hosting services typically provide DNS Servers to resolve subdomains within that master domain. Subdomain-en

A fully qualified domain name consists of multiple parts. For example, take the English Wikipedia domain en.wikipedia.org. The en is a subdomain of wikipedia.org. Although wikipedia.org is usually considered to be the

, wikipedia is actually a sub-domain of the org

TLD A top-level domain (TLD) is one of the domain name, domains at the highest level in the hierarchical Domain Name System of the Internet after the root domain. The top-level domain names are installed in the DNS root zone, root zone of the nam ...

(top level domain). Any fully qualified domain name can be a host or a subdomain. A domain name that does not include any subdomains is known as an ''apex domain'', ''root domain'', or ''bare domain''. For example, wikipedia.org is the apex domain of Wikipedia, which redirects to the subdomain www.wikipedia.org. To discover more subdomains associated with a domain, you can utilize a variety of methods and tools. Automated tools like Amass and Subfinder leverage open-source intelligence and SSL certificate data to quickly uncover subdomains. Google Dorking, using the "site:" operator, allows for manual searches of indexed subdomains, while brute force techniques systematically query DNS servers with potential names. Passive DNS reconnaissance through APIs from services like SecurityTrails & Subdomain Center can reveal historical data without direct queries. Additionally, community resources such as GitHub and Pastebin may contain publicly available lists of subdomains. Combining these approaches will enhance your ability to effectively identify hidden or overlooked subdomains for security assessments or research purposes.

Subdomain usage

Subdomains are often used by internet service providers supplying web services. They allocate one (or more) subdomains to their clients who do not have their own domain name. This allows independent administration by the clients over their subdomain. Subdomains are also used by organizations that wish to assign a unique name to a particular department, function, or service related to the organization. For example, a university might assign "cs" to the computer science department, such that a number of hosts could be used inside that subdomain, such as www.cs.example.edu. There are some widely recognized subdomains such as WWW and

FTP The File Transfer Protocol (FTP) is a standard communication protocol used for the transfer of computer files from a server to a client on a computer network. FTP is built on a client–server model architecture using separate control and dat ...

. This allows for a structure where the domain contains administrative directories and files including the FTP directories and webpages. The FTP subdomain could contain logs and the web page directories, while the WWW subdomain contains the directories for the webpages. Independent authentication for each domain provides access control over the various levels of the domain.

Uses

United Kingdom

In the

United Kingdom The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom (UK) or Britain, is a country in Northwestern Europe, off the coast of European mainland, the continental mainland. It comprises England, Scotlan ...

, the second-level domain names are standard and branch off from the

top-level domain A top-level domain (TLD) is one of the domain name, domains at the highest level in the hierarchical Domain Name System of the Internet after the root domain. The top-level domain names are installed in the DNS root zone, root zone of the nam ...

. For example: * .ac.uk:

academic An academy (Attic Greek: Ἀκαδήμεια; Koine Greek Ἀκαδημία) is an institution of tertiary education. The name traces back to Plato's school of philosophy, founded approximately 386 BC at Akademia, a sanctuary of Athena, the go ...

(

tertiary education Tertiary education (higher education, or post-secondary education) is the educational level following the completion of secondary education. The World Bank defines tertiary education as including universities, colleges, and vocational schools ...

further education colleges Further education (often abbreviated FE) in the United Kingdom and Ireland is additional education to that received at secondary school that is distinct from the higher education (HE) offered in universities and other academic institutions. It ...

and research establishments) and

learned societies A learned society ( ; also scholarly, intellectual, or academic society) is an organization that exists to promote an academic discipline, profession, or a group of related disciplines such as the arts and sciences. Membership may be open to al ...

* .co.uk: general use (usually

commercial Commercial may refer to: * (adjective for) commerce, a system of voluntary exchange of products and services ** (adjective for) trade, the trading of something of economic value such as goods, services, information or money * a dose of advertising ...

) * .gov.uk:

government A government is the system or group of people governing an organized community, generally a State (polity), state. In the case of its broad associative definition, government normally consists of legislature, executive (government), execu ...

(central and local) * .judiciary.uk:

court A court is an institution, often a government entity, with the authority to adjudicate legal disputes between Party (law), parties and Administration of justice, administer justice in Civil law (common law), civil, Criminal law, criminal, an ...

s (to be introduced in the near future) * .ltd.uk: limited companies * .me.uk: general use (usually

person A person (: people or persons, depending on context) is a being who has certain capacities or attributes such as reason, morality, consciousness or self-consciousness, and being a part of a culturally established form of social relations suc ...

al) * .mod.uk: Ministry of Defence and HM Forces public sites * .net.uk: ISPs and network companies (unlike

.net The .NET platform (pronounced as "''dot net"'') is a free and open-source, managed code, managed computer software framework for Microsoft Windows, Windows, Linux, and macOS operating systems. The project is mainly developed by Microsoft emplo ...

, use is restricted to these users) * .nhs.uk:

National Health Service The National Health Service (NHS) is the term for the publicly funded health care, publicly funded healthcare systems of the United Kingdom: the National Health Service (England), NHS Scotland, NHS Wales, and Health and Social Care (Northern ...

institutions * .nic.uk
network use only
( Nominet UK) * .org.uk: general use (usually for

non-profit organisation A nonprofit organization (NPO), also known as a nonbusiness entity, nonprofit institution, not-for-profit organization, or simply a nonprofit, is a non-governmental (private) legal entity organized and operated for a collective, public, or so ...

s) * .parliament.uk: parliamentary use (only for the

UK Parliament The Parliament of the United Kingdom of Great Britain and Northern Ireland is the supreme legislative body of the United Kingdom, and may also legislate for the Crown Dependencies and the British Overseas Territories. It meets at the Palace of ...

and the

Scottish Parliament The Scottish Parliament ( ; ) is the Devolution in the United Kingdom, devolved, unicameral legislature of Scotland. It is located in the Holyrood, Edinburgh, Holyrood area of Edinburgh, and is frequently referred to by the metonym 'Holyrood'. ...

) * .plc.uk:

public limited companies In public relations and communication science, publics are groups of individual people, and the public (a.k.a. the general public) is the totality of such groupings. This is a different concept to the sociological concept of the ''Öffentlichke ...

* .police.uk:

police forces The police are a constituted body of people empowered by a state with the aim of enforcing the law and protecting the public order as well as the public itself. This commonly includes ensuring the safety, health, and possessions of citize ...

* .sch.uk: Local Education Authorities,

school A school is the educational institution (and, in the case of in-person learning, the Educational architecture, building) designed to provide learning environments for the teaching of students, usually under the direction of teachers. Most co ...

s, primary and

secondary education Secondary education is the education level following primary education and preceding tertiary education. Level 2 or ''lower secondary education'' (less commonly ''junior secondary education'') is considered the second and final phase of basic e ...

, community education

Vanity domain

A vanity domain is a subdomain of an ISP's domain that is aliased to an individual user account, or a subdomain that expresses the individuality of the person on whose behalf it is registered.

Server cluster

Depending on application, a record inside a domain, or subdomain might refer to a hostname, or a service provided by a number of machines in a cluster. Some websites use different subdomains to point to different server clusters. For example, www.example.com points to Server Cluster 1 or Datacentre 1, and www2.example.com points to Server Cluster 2 or Datacentre 2 etc.

Subdomains versus directories

Subdomains are different from directories. Directories are physical folders on an actual computer, while subdomains are a part of the URL that can be routed to any file or folder on the server machine.

References

{{reflist Domain Name System