Subdomain Monitoring

A Subdomain monitor keeps an inventory of your domain's subdomains and warns you about the two changes that matter: a subdomain you didn't know about, and a subdomain someone else could take over.

On every check it:

1. Finds subdomains in Certificate Transparency logs — the public record of every TLS certificate issued. Any hostname under your domain that ever had a certificate shows up, including forgotten staging, preview and vendor hostnames. A wildcard certificate for *.dev.example.com counts as dev.example.com.
2. Checks each one in DNS:
   • Live — it resolves; the addresses are shown.
   • No DNS — it had a certificate once but no longer exists in DNS.
   • Dangling CNAME — it points (CNAME) at a name that doesn't exist, such as a deleted cloud storage bucket, app or expired domain. Whoever registers that name can serve content on your subdomain — the classic subdomain takeover.
3. Compares with the previous check. The first check records the current list without alerting. After that, a new subdomain fires the default "New Subdomain Detected" alert and a newly dangling CNAME fires the default "Dangling Subdomain CNAME Detected" alert (critical) — no setup needed.

Availability

Requires a plan with Subdomain Monitoring (Professional and above). Your plan also sets how many subdomains one check covers (by default Professional 500, Enterprise 5,000).

How it works

curl -X POST https://api.monsphere.com/api/v1/organizations/{orgId}/monitors \
  -H "X-Api-Key: msph_live_..." -H "Content-Type: application/json" \
  -d '{
    "name": "Company Subdomains",
    "type": "subdomain",
    "target": "example.com",
    "intervalSeconds": 86400,
    "config": { "subdomainIgnore": ["customer-", "preview."] }
  }'

• target — your registered domain (e.g. example.com), not a subdomain. A pasted URL is reduced to its host.
• subdomainIgnore — optional, up to 100: subdomains containing any of these are left out (useful for per-customer hostnames that come and go by design).
• The monitor itself only goes down when the check can't run — both Certificate Transparency searches unreachable, or a DNS resolver that can't be trusted. Findings are a result, not an outage.
• Checks run at most every 6 hours. Changing the domain or the ignore list starts a fresh baseline.

How it runs

Certificate Transparency is searched through crt.sh, with SSLMate's CertSpotter as the fallback when crt.sh is unavailable — the check result says which one answered. Before trusting DNS answers, the check confirms its resolver returns "does not exist" for a name that can't exist; on a domain with wildcard DNS every name resolves, which the result points out (dangling CNAMEs are still detected). Subdomains that never had a certificate aren't in the logs and aren't guessed — no DNS brute-forcing. Per-subdomain results are kept for your plan's history retention period.