🔍 Subdomain Finder

How the subdomain scanner works

There is no single DNS query that returns every subdomain of a domain — DNS zone transfers are (rightly) blocked on almost every nameserver. So a good subdomain finder gathers candidate names from several sources and then verifies them. This scanner combines a passive source and an active one, then resolves everything:

1. Certificate transparency logs (passive)

Every time a certificate authority issues a TLS certificate it logs the hostnames to public, append-only certificate transparency (CT) logs. We query these logs (via crt.sh) for names that have appeared on a certificate for your domain. Because almost every subdomain that ever served HTTPS needed a certificate, CT is a high-signal, historical source — it surfaces real, confirmed names like dev., jenkins., or vpn. that a wordlist would never guess. The trade-off: CT only shows names that were put on a certificate, so a subdomain that never served HTTPS (or hid behind a wildcard *.example.com certificate) won't appear here.

2. Common-name checks (active)

We also test a curated list of around 370 of the most common subdomain names — www, mail, api, dev, staging, vpn, admin, cdn, and many more. This catches live subdomains that never appeared in a certificate log. Its limit is the opposite of CT's: it only finds names on the list, so an unusual name like q3-migration-temp won't be guessed.

3. Live resolution & verification

The two candidate lists are merged and de-duplicated, then every name is resolved with a DNS lookup (A record, then CNAME). Only names that actually resolve are shown, along with where they point and the hosting provider we detect. If the domain answers for random names (a wildcard record), guessed names that only "exist" because of the wildcard are filtered out so the list stays honest.

Want the manual techniques too — search operators, mining a domain's own records, combining OSINT feeds? Read the guide: How to find all subdomains of a domain. Auf Deutsch: Subdomains herausfinden.

Subdomain lookup results explained

Each row of the subdomain lookup shows the name, whether it resolves by A record or CNAME, the IP address or CNAME target, the provider we recognise, and the source that found it (certificate log, common name, or both). A few patterns are worth checking for every subdomain:

• Private IPs — a public subdomain resolving to a 10.x or 192.168.x address is leaking internal detail (we flag these).
• staging., dev., test., uat. — non-production environments often exposed by accident.
• vpn., remote., portal., admin. — high-value access points worth locking down.
• A CNAME pointing at a decommissioned service — a dangling CNAME can be claimed by someone else (a subdomain takeover). Run the single-subdomain check below on anything suspicious.

Audit the records behind your subdomains with a DNS health check, and look up ownership with WHOIS.

Check a specific subdomain

Enter a full hostname such as shop.example.com instead of the bare domain and the tool switches into subdomain checker mode. Alongside the scan you get a verification card for that exact name:

• Does it resolve? — the A and AAAA addresses it points to, and whether any of them are private.
• CNAME chain — every hop to the final target, with a warning when the target returns NXDOMAIN (a dangling CNAME).
• Wildcard check — whether the parent zone answers for random names, and whether this subdomain only "exists" because of that wildcard.
• What it serves — the HTTP status on port 80 or 443.
• Subdomain takeover assessment — if the CNAME points at a hosted platform (GitHub Pages, Azure, Heroku, Shopify, Netlify, S3 and around 40 others) whose resource no longer exists, or the platform serves its "unclaimed" page for your hostname, the checker flags a possible or likely takeover so you can delete the record before someone else claims it.

Use it after a migration or decommission to confirm old names are really gone, and on anything the scanner surfaces that you don't recognise.

Frequently Asked Questions

Can I check a single subdomain?

Yes. Enter the full hostname (for example shop.example.com). You'll get a verification card showing whether it resolves, its CNAME chain and final target, a wildcard check, the HTTP status it serves, and a subdomain takeover assessment — plus a scan for names beneath it and under the root domain.

How many names does the subdomain scanner check?

Every scan tests around 370 common subdomain names plus every distinct name found in certificate transparency logs for the domain (capped at 200 log-discovered names per scan for very large certificate histories). Each candidate is resolved live, so the count shown is the number of names actually checked.

Does it show the IP address each subdomain resolves to?

Yes. Each subdomain is shown with its A-record IP address or, for aliases, the CNAME target it points at, together with the hosting or CDN provider we recognise (Cloudflare, AWS, Azure, GitHub, Netlify and others). Private IP addresses are flagged.

Why does every name resolve? (wildcard DNS)

The domain has a wildcard record (*.example.com), so any name — even a random one — answers with the same address. The scanner detects this, suppresses guessed names that only match the wildcard, and keeps names confirmed by certificate logs. The single-subdomain check tells you whether a specific name matches the wildcard or points somewhere deliberate.

What is a subdomain takeover, and how does the checker detect it?

A subdomain takeover happens when a CNAME still points at a hosted service (a storage bucket, an app platform, a help centre) after the resource behind it was deleted: whoever re-creates that resource can serve content on your subdomain. The checker follows the CNAME chain, tests whether the target still exists, and compares what the host serves against the "unclaimed" pages of around 40 platforms. Remove the DNS record for any service you no longer use.

Is the subdomain finder free?

Yes. This subdomain finder is completely free, and the certificate transparency logs it reads are public. No sign-up or API key is required.

Is subdomain enumeration legal?

Reading public sources like certificate transparency logs is generally fine for research. Actively scanning infrastructure you don't own or aren't authorized to test can cross legal lines — stick to your own domains or authorized engagements.