subfinder: a host belongs to the input domain on that line

Input and host are a pair

A subfinder result can carry the domain you asked about and the hostname a source returned. The hostname is a report for that input, on that run. A second domain in the same command gets its own lines. The two lists are not one pool.

Moving a name from one parent to another because the labels look similar is a guess. The line does not say the name is also under the other domain.

A single-domain run is still an input

If you only passed one domain, every host on the list was returned for that domain. Write the domain once at the top of the note so a later paste of bare hostnames still has a parent. A bare hostname in a ticket, with the domain left off, can be read as a different zone.

The sources on the line still do not make the name a live service. They say which datasets returned it for that input.

What to file

File the input domain, the hostname, the sources, and the run time, as one block per name. If the export has no input field, file the domain you passed and say the file did not repeat it per line. Do not merge two domains’ lists and then sort them back apart by eye.

Worked case: a name filed under the wrong parent

One lab run asks about hackblue-lab.org and about lab-partner.example. A line returns files.lab-partner.example for the partner input. A draft adds files.lab-partner.example to the hackblue-lab.org inventory because both strings contain “lab.”

The note quotes the input lab-partner.example, the hostname, and the sources. The name stays on the partner list. It is not a hackblue-lab.org host. The similarity of the labels is not a field on the line.

run: 2026-11-03T09:10:00Z
input: lab-partner.example
host: files.lab-partner.example
sources: crt.sh
hackblue-lab.org inventory: not this line
write: the pair as printed