Subdomain Finder

Build an inventory of a domain's subdomains from public certificate records.

GO DEEPERWhat do you want to uncover next?
🔎 Investigate discovered subdomains🔒 Check SSL on a discovered host🌐 Inspect DNS for a discovered host

What this tool checks

  • Subdomain names from certificate transparency logs
  • Which names currently resolve
  • A, AAAA and CNAME targets

How to read the result

Only subdomains that have had a public certificate issued appear, so the list is a strong inventory but not complete. Use it to find forgotten hosts.

Terms explained

CNAME RecordDNS Zone TransferSRV RecordWildcard DNS RecordCertificate TransparencySubdomain Takeover

Frequently asked questions

Is this legal to use?

It reads public certificate logs and DNS answers; it does not attack anything. Only test domains you are responsible for or are permitted to review.

Why is a known subdomain missing?

It may use a wildcard certificate or have no certificate.

What should I do with old subdomains?

Remove DNS records you no longer use. See subdomain takeover.