Subdomain Brute-Force Wordlists in 2026: What Still Works

Subdomain Brute-Force Wordlists in 2026: What Still Works

Pure wordlist blasting still finds hosts. The difference in 2026 is noise: cloud vanity DNS, per-PR preview hostnames, and CDN edge names can explode your result set while hiding nothing useful.

A good list is shorter than you think and tuned to the company you are testing.

Build from the target, not from GitHub cosplay

Start passive. Certificate transparency, historical DNS, and the program's own public docs already name patterns: api-, admin-, ${region}-, ${product}-. Extract tokens from those names before you download a 10-million-line list.

Layer lists in this order:

1. Org-derived: product names, ticker, acquired brands, common abbreviations from LinkedIn job posts and changelogs
2. Role shortlist: vpn, citrix, okta, grafana, gitlab, status, staging, preprod, bastion
3. Provider patterns: *.cloudfront.net CNAMES are clues to origin naming; Azure and GCP project prefixes leak in CT
4. Generic DNS lists: only after the above, and preferably permutations of discoveries (dev-api → dev-api-2, api-dev)

I've burned evenings on all-time-greatest wordlists and walked away with 4,000 NXDOMAIN timeouts and one autodiscover everyone already knew. Permuting confirmed names usually wins.

Resolvers and rate, not ego

Use trusted resolvers and validate wildcards first. If zjqqx.target.example returns the same A record as aaaaa.target.example, you are in a catch-all. Record the sinkhole address and filter it or you will report infinity.

Respect scope. Brute only in-scope apex domains. Parallelism that looks like a DDoS against the company's authoritative NS is a fast way off a program. Prefer puredns/massdns style pipelines with a sane QPS, then re-resolve survivors through a second resolver to kill poison and flukes.

HTTP probe after DNS, not during. A name that resolves to a private IP is still a finding for the map; do not port-scan it until the policy allows.

Wordlist hygiene for 2026

Drop ancient Windows NT lab names unless the org is actually that old. Add:

• Environment suffixes: -eu, -usw2, -canary, -canary2
• Feature flags style: exp, beta, preview, edge
• Merge leftovers: old company domains still in scope after acquisitions
• Service mesh leftovers: *-grpc, *-mtls, *-internal appearing in CT

Keep a deny list for names that always collide with public SaaS vanity DNS outside your scope.

When a program publishes multiple apex domains, run permutations per apex rather than one mega-list. api on brand-a.example and brand-b.example are different bets; merging them hides which product actually answered.

What to put in the report

Triage does not want your wordlist. They want the interesting host, why it matters (auth panel, staging with prod SSO, forgotten .git later), and how you found it. Mention brute force in one sentence if required for methodology; lead with impact.

Refresh lists after each program. The 2026 edge is curation and permutation, not who downloaded the biggest file.