Free tool

Attack Surface Mapper

See everything an attacker can discover about your domain in one view: subdomains, IPs, mail and name servers.

Passive: public certificate transparency logs and DNS only. Nothing intrusive.

What this checks

Lists up to 60 subdomains found in public Certificate Transparency logs.
Resolves the domain's IPv4 addresses (A records).
Lists mail servers (MX) and name servers (NS).
Notes whether an SPF record is published, and shows counts for each category in one summary.

Why it matters

Your attack surface is everything about your organisation that can be reached or learned from the internet. Attackers begin with this kind of passive reconnaissance because it costs them nothing and alerts no one. Seeing your own surface in one view helps a school, clinic or business decide what should be public, what should be behind a login, and what should be switched off.

How to read the result

A large subdomain count is not bad in itself; what matters is whether each one is still needed and maintained.
Several unrelated IP addresses can mean services spread across different hosts, each of which needs its own patching.
Mail and name servers show which providers your organisation depends on. An unfamiliar provider is worth investigating.
No SPF means your domain can be spoofed more easily. Follow up with the Email Security Checker for the full email picture.

How to fix what it finds

Work through the subdomain list and retire anything that is no longer used, removing its DNS record as well.
Put admin panels, staging sites and internal tools behind a VPN, IP allow list or single sign on, rather than leaving them public.
Publish SPF and DMARC if they are missing.
Repeat this check after any website, hosting or email change, and keep a dated copy of the result for comparison.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

What is an attack surface?

It is the total set of points where an attacker could try to get in or gather information: websites, subdomains, mail servers, remote access and exposed services. Reducing it means fewer things to defend.

Is this the same as a penetration test?

No. This is passive mapping from public records; it does not test whether anything is vulnerable. A penetration test goes further and actively, with permission, tries to exploit what is found.

Can attackers really see all this?

Yes. Everything shown comes from public DNS and public Certificate Transparency logs, which anyone can query without permission.