What the technique does
Subdomain enumeration is the survey of names existing beneath a domain: api.example.com, staging.example.com, old-panel.example.com. It is the first practical step of any external mapping, and it is done the same way by the security team and by whoever is on the other side.
The goal is not the list of names. It is reaching the ones that answer, because a name that does not resolve is not surface.
The public sources
Certificate issuance logs. Every certificate authority publishes what it issued, with the name on the certificate. An internal environment that got a valid certificate announced its own name in that log.
DNS. Direct queries, misconfigured zone transfers, and records left pointing at services that went offline.
Web crawl archives. Search engines and archiving projects keep URLs seen over the years, including pages the company already removed.
Public code and configuration. An internal address appearing in an open repository, in a config file published by mistake, or inside a package that shipped.
None of these sources requires interaction with the target's infrastructure. They are why the map exists on the outside before it exists on the inside.
Passive and active
Passive queries those sources and does not touch the target. Active tests names against the server to find those that exist and are published nowhere, which generates identifiable traffic and requires authorization.
The efficient order is passive first, because it returns most of the result at no cost or risk, and active after, over what remains open.
The easy part and the hard part
Finding names is the easy part. Open tools do it well, and the list comes out large.
Deciding what is yours is the hard part, and it is where the exercise usually stops. The raw list carries names that no longer resolve, names belonging to another company by string coincidence, names of a service the company hired and never knew would get its own address, and names of a brand the organization sold two years ago.
An inventory built on the raw list overcounts, and one built only on what the company already recognized undercounts. Resolving that is attribution, a different problem from enumeration and far less automatable.
Why it ages fast
Today's result describes today. A new subdomain goes live every week, and a quarterly survey produces the feeling of coverage without the coverage.
This is why the technique only produces sustained value inside a continuous attack surface management cycle, rather than as a one-off exercise.