Skip to main content

Domain Checker

The Domain Checker discovers publicly known subdomains for a root domain using passive discovery: it queries public data sources (certificate transparency logs, DNS datasets) via the open-source subfinder tool, without ever probing your servers. You then review the results and bulk-import selected hostnames as SSL certificate tokens, optionally creating endpoint monitors at the same time.

It does not scan private DNS or internal network records. Only publicly known subdomains are discovered.

Plan availability​

On TokenTimer Cloud, the Domain Checker requires a Pro or Team workspace plan. Discovery and import volumes are capped per plan; see Plan limits. On the Free plan, the API returns PLAN_FEATURE_REQUIRED.

How it works​

  1. Open Endpoint & SSL monitor on the dashboard and switch to the Domain Checker.
  2. Enter a root domain (for example example.com) and run a lookup. TokenTimer queries subfinder's passive discovery sources and returns the publicly known subdomains it found. If only some discovery sources respond, the result is marked partial.
  3. Review the results and select the hostnames you want to track.
  4. Import the selection. Each hostname's live SSL certificate is fetched and imported as an ssl_cert token. Hostnames are skipped when they are duplicates, do not resolve in DNS, or fail validation; the import summary shows counts per skip reason.
  5. Optionally enable create monitors during the import to also create endpoint monitors for the imported hostnames, with a check interval, health checking, an "alert after failures" value, and a contact group.

Rate limits​

Lookups are rate limited per workspace and per user to keep discovery sources healthy. If you hit the limit, wait and retry.

Audit trail​

Lookups and imports are recorded as DOMAIN_CHECKER_LOOKUP and DOMAIN_CHECKER_IMPORT audit events, including result counts and skip reasons. See the audit event catalog.