Free Security Tool

Subdomain Finder

Find every subdomain in Certificate Transparency logs and see which are live.

Get the full picture for your domain

Free recon check of your external footprint: headers, TLS, DNS, subdomains and CVE signals. Your report and a PDF summary, sent to your work email on that domain.

Free External Security Check

How subdomain enumeration works

This tool reads Certificate Transparency (CT) logs, the public, append-only record of every certificate a trusted Certificate Authority issues. A certificate for staging.example.com writes that name to CT, so searching the logs finds subdomains without sending a single request to the target. Each name is then resolved through DNS to show whether it is live and where it points.

How to read your subdomain finder results

  • Live: resolves to an IP right now. This is your active attack surface; start with names like staging., dev., admin. and api.
  • Not resolving: a certificate was issued but DNS no longer answers. Not automatically safe: a record still pointing at a decommissioned cloud service can be a takeover target.
  • IP address: where each live subdomain points. Shared hosts or an unexpected cloud provider are worth a closer look.

What to do about exposed subdomains

  • Inventory first. Any host you cannot attribute to an owner is a blind spot nobody patches.
  • Check the live ones. Run the security header checker against hosts you cannot attribute. No security headers usually means nobody maintains it.
  • Remove dangling records. A dead subdomain whose DNS still points at a cloud service can sometimes be reclaimed by an attacker.

Only enumerate and assess domains you own or are expressly authorised to assess. See our acceptable use policy.

Frequently asked questions

How do I find all subdomains of a domain?

Enter the root domain above. The tool searches public Certificate Transparency logs for every certificate issued under it, then resolves each name through DNS to show which are live. It is passive: no traffic is sent to the target. Subdomains that never had a public certificate will not appear, so pair the results with your own DNS records.

How do I find subdomains for free?

This subdomain finder is free with no signup. Type a domain, press Find, and you get the discovered subdomains, their live status and their IP addresses, which you can copy as a list.

What is subdomain enumeration?

Discovering all the subdomains of a domain. Names like staging.example.com, api.example.com or admin.example.com often expose extra attack surface, so security teams enumerate them to map every internet-facing asset.

What is Certificate Transparency?

A public framework requiring Certificate Authorities to log the certificates they issue. Because the logs are searchable, anyone can see which certificates, and therefore which subdomains, exist for a domain.

What should I do about exposed subdomains I find?

Attribute every host to an owner, check the live ones for weak configuration, remove dangling DNS records that could enable a takeover, and get the ones worth testing assessed. A free External Security Check maps the surface to the Essential Eight, SOC 2 and ISO 27001 controls it touches.

Is this subdomain scan legal?

Yes. It only queries public Certificate Transparency logs and performs standard DNS lookups. No intrusive scanning or vulnerability testing is performed. Use it only against domains you own or are authorised to assess.