Although there are many tools out there that do a great job of enumerating sub-domains, I feel the one that does the best is  It is also very good at fingerprinting a web server as well.

Netcraft provides research data and analysis among many of its services.  When you enter a website into Netcraft’s search bar, it returns all the sub-domains know for the site, a site report with important network and background information , as well as a basic fingerprint of the hosting provider and web server.

Example Sub-Domain Enumeration:

Example Site Report:


This just scratches the surface of what Netcraft can do to enumerate a web site.