> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain & Subdomain Discovery

> Continuously enumerate root domains, live subdomains, Wildcard DNS, and orphaned records.

Subdomain proliferation is one of the leading causes of security incidents, creating opportunities for **subdomain takeover** and unmanaged test systems.

***

## Discovery Workflows

1. **Root Domain Registration**: Input organization apex domains (e.g., `snapsec.co`, `acmepayments.com`).
2. **Recursive Enumeration**: Snapsec recursively queries horizontal and vertical subdomains.
3. **Live Resolution Verification**: Validates whether DNS records resolve to active IPs or return NXDOMAIN.
4. **Takeover Detection**: Flags dangling CNAME pointers pointing to unclaimed cloud buckets (AWS S3, Azure Blob, GitHub Pages, Heroku).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.