How do I find the subdomains of a domain?

Enter the domain and run the finder. It combines two sources. Passive: it queries Certificate Transparency logs via crt.sh, which lists every publicly issued TLS certificate. Active: it DNS-probes a list of about 1,000 common subdomain names (mail, blog, dev, staging, api, vpn, etc.). Every name found is then checked in DNS.

Are subdomains public?

Many are. A subdomain that ever had a publicly trusted TLS certificate is recorded in Certificate Transparency logs, which anyone can search, so it is public even if nothing links to it. A name that never had a certificate stays private unless someone guesses it. How that happens and what it means for a site: Certificate Transparency: anyone can list your subdomains.

Will this find ALL subdomains for a domain?

No. Anything that never appeared in a public certificate AND is not one of the common names the tool probes will be missed. Private subdomains used only inside a corporate network are also invisible. Treat the result as a fast reconnaissance starting point, not an exhaustive audit.

Is using this tool legal or safe?

Subdomain enumeration via passive CT logs and common-name probing is non-intrusive (no port scanning, no exploit attempts) and widely used by security researchers and ops teams. The DNS probes go through public resolvers, not to the target's nameservers directly.

Why does the finder list fewer names than crt.sh?

CT logs are historical: a cert issued a year ago for `old-app.example.com` stays in crt.sh forever, even if the subdomain is long retired. The tool checks every name in DNS and lists only the subdomains that exist now.

What's a good next step after finding subdomains?

For each interesting subdomain: check live HTTP headers with HTTP Headers, inspect the TLS via SSL Checker, confirm where it points with DNS Lookup.

Free, rate-limited per IP (3 requests per minute, since each scan runs about 1,000 DNS lookups plus a crt.sh fetch).

WEB

Subdomain Finder

Find subdomains (limited)

Input

Find and check the subdomains of a domain: Certificate Transparency logs (crt.sh) plus about 1,000 common names, each checked in DNS.

Terminal

Console ready. Execute a command to see output...

About Subdomain Finder

How to find subdomains of a domain

Enter a domain to look up its subdomains. The finder combines two sources: Certificate Transparency logs, the public record of every trusted TLS certificate, and a check of about 1,000 common names such as mail, dev and vpn. Every name is checked in DNS, and only the ones that exist now are listed, each with its address, country and network. Subdomain enumeration is the usual first step of a security audit: it shows how much of an organization's infrastructure is reachable from outside.

Hidden Treasures

test.example.com: May have weak passwords.
vpn.example.com: Critical entry points, and one reason small teams are replacing the VPN with zero trust access.
old.example.com: Legacy systems that haven't been patched in years.

How it works: the tool queries Certificate Transparency logs via crt.sh (passive, fetches historical issued certificates), then DNS-probes a list of common subdomain names (active, about 1,000 names) to catch entries that never appeared in a public certificate. Results appear as they are found. Not exhaustive, but a fast pragmatic mix.

How to use Subdomain Finder

Enter the apex domain
Just the bare domain, e.g. example.com. Subdomain inputs do not enumerate further levels reliably.
Hit Find Subdomains
The tool queries crt.sh and checks about 1,000 common names in DNS. Results appear as they are found.
Read the result
Each subdomain that exists now, with its address, country and network. Names from old certificates that no longer resolve are left out.
Verify and explore
Use HTTP Headers and SSL Checker on the subdomains that resolve, and DNS Lookup for their other records.

Frequently Asked Questions

: Enter the domain and run the finder. It combines two sources. Passive: it queries Certificate Transparency logs via crt.sh, which lists every publicly issued TLS certificate. Active: it DNS-probes a list of about 1,000 common subdomain names (mail, blog, dev, staging, api, vpn, etc.). Every name found is then checked in DNS.
: Many are. A subdomain that ever had a publicly trusted TLS certificate is recorded in Certificate Transparency logs, which anyone can search, so it is public even if nothing links to it. A name that never had a certificate stays private unless someone guesses it. How that happens and what it means for a site: Certificate Transparency: anyone can list your subdomains.
: No. Anything that never appeared in a public certificate AND is not one of the common names the tool probes will be missed. Private subdomains used only inside a corporate network are also invisible. Treat the result as a fast reconnaissance starting point, not an exhaustive audit.
: Subdomain enumeration via passive CT logs and common-name probing is non-intrusive (no port scanning, no exploit attempts) and widely used by security researchers and ops teams. The DNS probes go through public resolvers, not to the target's nameservers directly.
: CT logs are historical: a cert issued a year ago for old-app.example.com stays in crt.sh forever, even if the subdomain is long retired. The tool checks every name in DNS and lists only the subdomains that exist now.
: For each interesting subdomain: check live HTTP headers with HTTP Headers, inspect the TLS via SSL Checker, confirm where it points with DNS Lookup.
: Free, rate-limited per IP (3 requests per minute, since each scan runs about 1,000 DNS lookups plus a crt.sh fetch).