Subdomain Finder
Discover a domain's subdomains — map the full web footprint.
Powered by crt.sh Certificate Transparency logs — free, no key required.
How to use Subdomain Finder
- Enter the domain — one you own or are authorized to assess.
- Review discovered subdomains — from CT logs and DNS sources.
- Audit each: forgotten/outdated services and dangling CNAMEs are the priority findings.
- Investigate within scope — DNS, SSL and header checks per subdomain; nothing unauthorized.
What is Subdomain Finder?
A subdomain finder enumerates the subdomains under a domain — blog.example.com, api.example.com, mail.example.com, dev.example.com and the rest — mapping the full surface of an organization's web presence beyond the main site. Subdomains host distinct services, and finding them reveals how an operation is structured.
The security framing matters up front: subdomain enumeration is a core step in authorized security assessment (attack-surface mapping) — and it's the same reconnaissance attackers run. Use it on your own domains, or with explicit permission on others; never for unauthorized probing.
About the Subdomain Finder
Enter a domain and discover its known subdomains, drawn from public sources (Certificate Transparency logs, DNS data, passive datasets).
Legitimate uses: your own attack-surface audit — the essential one, since organizations routinely forget subdomains they created (that staging. box from 2021 running outdated software is exactly what enumeration surfaces, and what attackers find first); subdomain-takeover checks — dangling CNAMEs pointing at deprovisioned services are a classic, findable vulnerability; infrastructure understanding — mapping how a service organizes (API endpoints, regional sites, admin panels); and bug-bounty scoping within authorized programs.
Method and limits: much discovery now comes from Certificate Transparency (every HTTPS cert publicly logs its hostnames — a rich, passive source), supplemented by DNS and wordlist data; results are strong but never exhaustive (internal-only and never-certified subdomains stay hidden). Findings feed onward — DNS/SSL/HTTP-header checks per subdomain, and ping/port scans within authorized scope.