Free Security Tool

Subdomain Finder

Discover all subdomains for any domain using Certificate Transparency logs. See which are live and map your attack surface. Free. A work email unlocks the full list with IP addresses.

How subdomain enumeration works

A subdomain finder (also called a subdomain checker, scanner, lookup, or search tool) discovers the subdomains attached to a root domain. Organisations run dozens or hundreds of them: staging environments, API gateways, admin panels, developer sandboxes, and legacy apps. Each one is a possible way in, so mapping the full set is the first step in understanding your external attack surface.

This tool reads Certificate Transparency (CT) logs, a public, append-only record of every SSL/TLS certificate issued by a trusted Certificate Authority. When a certificate is issued for staging.example.com, that name is written to CT. Searching those logs lets us find all subdomains for a domain without sending a single request to the target, so the scan is passive and non-intrusive. Each discovered name is then resolved through DNS to show whether it is live and where it points.

How to read your subdomain finder results

  • Live: the subdomain resolves to an IP and is reachable right now. These are your active attack surface. Prioritise the ones whose names suggest weaker controls, such as staging., dev., admin., and api.
  • Not resolving: a certificate was issued at some point, but DNS no longer answers for the name. These are not automatically safe. If the record still points at a decommissioned cloud service, it can be a subdomain takeover target.
  • IP address: shows where each live subdomain points. Several subdomains sharing one host, or an unexpected cloud provider IP, are both worth a closer look.

What to do about exposed subdomains

  • Inventory first. Compare the list against your asset register. Any host you cannot immediately attribute an owner to is a blind spot, and blind spots are the parts nobody patches.
  • Check the live ones for basic hygiene. Run the free security header checker against the hosts you cannot attribute. A subdomain with no security headers is usually one nobody is maintaining.
  • Watch the not-resolving names. A dead subdomain that still has a dangling DNS record pointing at a cloud service can sometimes be reclaimed by an attacker. Remove records you no longer use.
  • Map your surface to controls. A free External Security Check shows how your exposed surface maps to the Essential Eight, SOC 2 and ISO 27001 controls it touches, so you know which findings carry audit weight.

Only enumerate and assess domains you own or are expressly authorised to assess. See our acceptable use policy.

Frequently asked questions

How do I find all subdomains of a domain?

Enter the root domain above and this tool searches public Certificate Transparency logs for every certificate ever issued under it, then resolves each name through DNS to show which are live. It is passive: no traffic is sent to the target. CT logs will not include subdomains that never had a public certificate, so pair the results with your own DNS records for a complete picture.

How do I find subdomains for free?

This subdomain finder is free with no signup. Type a domain, press Find, and you get the discovered subdomains, their live status, and their IP addresses, which you can copy as a list.

What is Certificate Transparency?

Certificate Transparency is a public framework requiring Certificate Authorities to log the SSL/TLS certificates they issue. Because the logs are searchable, anyone can see what certificates exist for a domain, and therefore what subdomains exist.

What should I do about exposed subdomains I find?

Attribute every host to an owner, check the live ones for weak configuration, remove dangling DNS records that could enable a takeover, and get the ones worth testing assessed. A free External Security Check maps the surface to the controls it touches.

Is this scan legal?

Yes. It only queries public Certificate Transparency logs and performs standard DNS lookups. No intrusive scanning or vulnerability testing is performed. Use it only against domains you own or are authorised to assess.