Subdomain Extractor
Extract subdomains from hostnames in bulk
Input Domains
Supports multi-part TLDs like .co.uk, .com.au, etc.
Extraction Results
Extraction results will appear here
The Subdomain Extractor isolates the subdomain portion of hostnames by removing the root domain identified via the Public Suffix List. Enter a hostname like app.staging.example.com and the tool returns app.staging as the subdomain -- the labels that precede the registrable domain. It handles bulk input for processing entire hostname lists at once.
Understanding Subdomain Extraction
Subdomains are the labels that come before the registrable domain in a hostname. In api.v2.prod.example.com, the registrable domain is example.com and the subdomain portion is api.v2.prod. These labels represent the internal structure that an organization has chosen for its domain: environment names like staging or prod, service identifiers like api or cdn, and geographic prefixes like us-east or eu-west. Understanding this structure is valuable for DNS auditing, security analysis, and organizational mapping.
The challenge is that you cannot reliably extract subdomains without first correctly identifying the root domain. If you naively strip the last two labels from a hostname, you get wrong results for multi-level TLDs. For www.bbc.co.uk, stripping the last two labels gives you www.bbc as the subdomain, but the correct answer is just www because co.uk is the public suffix and bbc.co.uk is the root domain. This mistake is so common that it is worth emphasizing: any subdomain extraction that does not use the Public Suffix List will produce incorrect results for a significant number of hostnames.
This tool uses Mozilla's Public Suffix List to correctly identify the root domain boundary, then extracts everything to its left as the subdomain. It handles all the edge cases: multi-level TLDs like co.uk and com.au, private suffixes like github.io and amazonaws.com, hostnames with no subdomain at all, and internationalized labels encoded in Punycode. Bulk processing lets you analyze entire hostname inventories to discover naming patterns and identify anomalies.
How to Extract Subdomains from Hostnames
- Enter one or more hostnames, separated by newlines (e.g.,
api.prod.example.com) - The tool identifies the root domain using the Public Suffix List
- It strips the root domain to isolate the subdomain labels
- Review the output showing each hostname's subdomain portion, or "(none)" for bare root domains
Subdomain Extraction Examples
| Input Hostname | Subdomain | Root Domain |
|---|---|---|
www.example.com | www | example.com |
app.staging.example.com | app.staging | example.com |
api.v2.prod.mysite.co.uk | api.v2.prod | mysite.co.uk |
www.bbc.co.uk | www | bbc.co.uk |
example.com | (none) | example.com |
deep.nested.sub.example.org | deep.nested.sub | example.org |
myapp.github.io | (none) | myapp.github.io |
cdn.myapp.github.io | cdn | myapp.github.io |
Why Naive String Parsing Fails for Subdomains
Extracting subdomains by splitting on dots and dropping the last two labels only works for simple TLDs like .com or .org. It breaks for multi-level TLDs:
Naive approach: drop last 2 labels
"www.bbc.co.uk" -> subdomain = "www.bbc" (WRONG, should be "www")
"api.example.com.au" -> subdomain = "api.example" (WRONG, should be "api")
"app.mysite.co.jp" -> subdomain = "app.mysite" (WRONG, should be "app")
The Public Suffix List tells the tool that co.uk, com.au, and co.jp are all public suffixes, so the root domain includes three labels, and only the labels before the root domain are subdomains.
When to Use the Subdomain Extractor
- DNS zone auditing -- Listing all subdomain names in use across your domains to identify stale or unauthorized entries
- Subdomain naming pattern analysis -- Discovering common prefixes like
www,api,staging,devused across an organization - Security monitoring -- Detecting unusual or suspicious subdomain patterns that may indicate phishing or shadow IT
- Subdomain routing logic -- Extracting the subdomain component for application-level routing decisions
- Certificate inventory -- Analyzing which subdomains appear across your TLS certificates and SANs
- Migration planning -- Mapping subdomain structure before moving DNS zones between providers
How Subdomain Extraction Works
The extraction process uses the Public Suffix List (PSL) maintained by Mozilla to determine the boundary between the registrable domain and subdomains:
Step-by-Step Process
- Look up the public suffix: Match the rightmost labels of the hostname against the PSL to find the longest matching suffix (e.g.,
co.uk) - Identify the root domain: The public suffix plus one label to its left is the registrable domain (e.g.,
example.co.uk) - Extract the subdomain: Everything to the left of the root domain constitutes the subdomain labels (e.g.,
api.v2.prod)
Bulk Processing Features
When processing hostname lists, the tool provides:
- Deduplication: Identical subdomains across different root domains are preserved, but exact duplicate hostname entries are collapsed
- Grouping: Results can be grouped by root domain to see all subdomains under each registrable domain
- Sorting: Alphabetical sorting for easy visual scanning
- Empty subdomain handling: Bare root domains (no subdomain) are clearly marked
Subdomain Extraction in Practice
One of the most valuable uses of bulk subdomain extraction is discovering naming conventions across an organization. When you process the complete DNS inventory for a company, patterns emerge: every environment uses dev, staging, and prod prefixes, every region uses us-east, eu-west, and ap-south, and every service type uses api, admin, and portal. Documenting these patterns helps enforce consistency, and finding hostnames that deviate from the pattern often reveals shadow IT, forgotten test environments, or services set up by teams that were not aware of the naming standard.
Security teams use subdomain extraction to identify potential risks. A subdomain like test-payment-gateway.example.com might indicate a staging environment with production-like credentials that is exposed to the internet. Subdomains with patterns like vpn, remote, admin, or internal suggest services that should be checked for proper access controls. Comparing the extracted subdomain list against your known inventory helps identify unauthorized DNS entries that someone added without going through the proper change management process.
When preparing for a DNS migration, subdomain extraction gives you a clear picture of the complexity you are dealing with. A domain with three subdomains is simple to migrate. A domain with 200 subdomains across multiple naming patterns requires careful planning, and you need to understand the structure before you start moving records. Grouping the results by subdomain prefix helps you identify which services are involved and who needs to be consulted during the migration.
Frequently Asked Questions
What happens when a hostname has no subdomain?
When you enter a bare root domain like example.com, the tool reports that no subdomain exists. The entire input is the registrable domain with no labels preceding it. This is a valid result, not an error.
How are private suffixes like github.io handled?
Private suffixes in the PSL are treated the same as ICANN suffixes. For myapp.github.io, the public suffix is github.io (private), making myapp.github.io the root domain with no subdomain. But cdn.myapp.github.io has cdn as the subdomain and myapp.github.io as the root domain.
Can I extract subdomains from URLs instead of hostnames?
This tool expects hostname input. If you have full URLs, first use the URL → Hostname Extractor to strip schemes, ports, and paths, then pass the resulting hostnames to this tool for subdomain extraction.
Does the tool handle internationalized subdomains?
Yes. Subdomain labels containing Punycode-encoded internationalized characters (e.g., xn--nxasmq6b.example.com) are handled correctly. The tool works with the encoded form as it appears in DNS.
What is the difference between this tool and the Root Domain Extractor?
The Root Domain Extractor returns the registrable domain (e.g., example.co.uk). This tool returns the opposite: the subdomain portion (e.g., app.staging). They are complementary -- together they decompose any hostname into its two logical parts.
Can subdomains contain multiple levels?
Yes. There is no practical limit to subdomain depth. A hostname like a.b.c.d.example.com has a four-level subdomain a.b.c.d. This is common in environments that encode environment, region, service tier, and other metadata into the subdomain hierarchy.
Related Tools
- Root Domain Extractor - Extract root domain using the Public Suffix List
- URL → Hostname Extractor - Extract hostnames from URLs in bulk
- Hostname Validator - Validate hostnames per RFC 1123 standards
- FQDN Validator - Validate fully qualified domain names
- DNS Record Set Deduper - Find and remove duplicate DNS records