運維和安全排查要枚舉子域 DNS 記錄：dig 一次查一個，拼字典腳本效率低，商用探測平臺不給原始記錄。
可以做成什麼
能做成什麼
dig + 子域枚舉一體的 CLI：字典 + 證書透明度日誌聚合，輸出結構化 JSON；開源核心 + API 收費。
怎麼驗證它
讀完原帖的評論區，把重複出現的具體場景記下來——重複次數就是需求的密度。
搜索「DNS / 運維工具」相關的現有工具，確認它們只覆蓋了哪一環。
用一句話落地頁，投回 Stack Exchange 或同類社群，看有沒有人主動問價格。
已有方案與差異
amass/subfinder（枚舉強但無 DNS 細節）；dig（不枚舉）
社區原聲 · 熱門評論
熱門評論由機器翻譯為中文，點擊原帖核對原意。
For almost all domains not under your control, the problem in your request is here: without supplying nor even knowing the names of all these subdomains If the server is not yours, you can only count on using a DNS request to communicate with it. The DNS query which might list which subdomains exist under a given domain is AXFR, and you can use dig for that: $ dig axfr example.org @ns.example.org but on almost all servers this is disabled for unauthorized users. I looked over Wikipedia's List of DNS record types and found no other request types which would involve information on subdomains whe
ChatGPT suggested that the crt.sh web service from Sectigo could help find many or most of the public subdomains of a given domain. I tried it out, and it does indeed seem to work, though it took some playing with and won't give you everything for some sites. Additionally, it allows you to download results as CSV or JSON, which is useful for processing with tools. So with some caveats (explained below), for many sites you can accomplish this with a small workflow: 1. crt.sh The crt.sh website allows you to search a list of their records of certificates, such as are used for HTTPS. This should
社區原聲 · 熱門評論
熱門評論由機器翻譯為中文，點擊原帖核對原意。
打開原帖核對