How do I find all subdomains of a domain?

Start passively. Query Certificate Transparency logs for %.yourdomain.com — crt.sh or Cert Spotter return every hostname that ever appeared on a public certificate, which is usually the largest single list. Add your own DNS zone export if it is your domain, search engines with site:yourdomain.com, and internet-scan databases such as Censys and Shodan. Aggregator tools like subfinder or amass query dozens of such sources in one command. Then classify each name with DNS lookups: live, CNAME to a third party, dangling, or unresolved. Only after that, and only on domains you own, add active techniques such as DNS brute-forcing to find hosts that never had a certificate. Our free Subdomain Finder does the passive CT-plus-DNS pass in seconds.

Is subdomain enumeration legal?

Passive enumeration — reading Certificate Transparency logs, public DNS records, search engines and scan databases — sends nothing to the target and is legal everywhere, the same as reading a phone book. It is what security researchers, journalists and attackers all do first, and what an agency can safely do for a prospect. Active enumeration is different: brute-forcing thousands of DNS names, attempting zone transfers or sending HTTP requests to every discovered host interacts with the target's infrastructure and, depending on jurisdiction and volume, can be treated as unauthorised access or at least as hostile traffic. Do active enumeration only against domains you own or have written permission to test.

Why does a subdomain finder miss some of my subdomains?

Because passive sources only know what was published. Certificate Transparency records names that appeared on publicly trusted certificates, so a host served under a wildcard certificate, a host with an internal-CA certificate, or a host that never had HTTPS is invisible to CT. Search engines only know names that were linked; scan databases only know hosts that answered on scanned ports. For a complete inventory of your own domain, export the DNS zone from your provider — that is the ground truth — and run an active tool such as subfinder or amass in resolving mode against it. The gap between the passive list and the zone is itself a finding: names that never had HTTPS.

What is DNS enumeration and how is it different from subdomain enumeration?

DNS enumeration is the broader activity of extracting everything a domain's DNS reveals: name servers, mail exchangers, TXT records (SPF, DMARC, SaaS verifications), reverse lookups, and — where misconfigured — full zone transfers. Subdomain enumeration is the part of that focused on discovering hostnames, and it draws on non-DNS sources too, such as Certificate Transparency and search engines. In practice you do both: DNS records tell you which providers and services a domain uses, subdomain discovery tells you which hosts exist, and DNS lookups on each discovered host tell you whether it is live, delegated to a third party, dangling or gone.

Subdomain Enumeration — How to Find All Subdomains of a Domain

Subdomain enumeration is finding every hostname that exists under a domain — www, mail, staging, old-shop, and the ones nobody remembers. It is the first step of any attack and the first step of defending against one, and most of it can be done passively from public records: Certificate Transparency logs, DNS, search engines and internet-scan databases.

Why does subdomain enumeration matter?

Because the main site is rarely where a breach starts. It is the forgotten dev. host running an old CMS, the vpn. appliance nobody patched, the promo. CNAME pointing at a marketing tool cancelled last year. Attackers enumerate subdomains precisely because the long tail is soft. If you can produce the same list first, you can retire, fix or monitor each name before it is found for you. That list is the core artefact of attack surface management.

Passive vs active enumeration — what's the difference?

Passive — reading records that already exist: CT logs, DNS, search engines, archived pages, scan databases, code repositories. Sends nothing to the target. Legal and polite against any domain; this is what an attacker does first and what you should do for a prospect or a client before you have permission for more.
Active — asking the target: DNS brute-forcing thousands of candidate names, zone-transfer attempts, virtual-host probing, HTTP requests to every name. Finds hosts CT never saw. Do it only against domains you own or are authorised to test.

The Subdomain Finder is entirely passive: CT logs for the names, DNS for the status, no request to any host it finds.

Which passive sources find the most subdomains?

1. Certificate Transparency logs

Every publicly trusted TLS certificate is logged, and every certificate names its hosts. Searching CT for %.example.com returns every name that ever had HTTPS under the domain, including ones deleted years ago. It is the single richest passive source, and it is also its own kind of leak — see what CT logs reveal.

curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r '.[].name_value' | tr 'A-Z' 'a-z' | sed 's/\*\.//' | sort -u

2. DNS itself

Your own zone export is the ground truth for names you control. From the outside, the apex's MX, TXT and NS records reveal mail providers, SaaS verifications and hosting; reverse lookups on your IP ranges reveal PTR names; and a misconfigured server may still allow a zone transfer (AXFR) — the classic full-disclosure mistake, now rare.

3. Internet-scan databases

Censys and Shodan have already scanned the whole IPv4 space and indexed certificates and banners. Searching them for your organisation or domain returns hosts and services with no scanning on your part.

4. Search engines, archives and code

site:example.com -www in Google or Bing, the Wayback Machine's URL index, and GitHub code search all surface hostnames that appeared in links, docs or config files. Slow and noisy, but they find names with no certificate and no DNS record — pure history.

5. Aggregators and tools

subfinder, amass and similar tools query dozens of these sources at once, de-duplicate and optionally resolve the results. They are the right choice for maximum coverage; compared in subdomain enumeration tools.

How do you read an enumeration result?

A raw list of names is not yet useful. Classify each one with DNS:

Live — resolves to an address you recognise. An asset to score and patch.
CNAME to a third party — a helpdesk, blog platform, CDN or marketing tool serving content under your name. Inventory it; confirm you still use it.
Dangling — a CNAME whose target no longer resolves. The pre-condition for a subdomain takeover; fix the record today.
Unresolved — in certificate history, gone from DNS. History, not risk — unless it should still exist.

Common gotcha: wildcard certificates hide names from CT. If everything under your domain is served with *.example.com, CT knows only the wildcard, and a CT-based finder will return almost nothing. That is not a security flaw — it is the reason passive enumeration is a floor, not a ceiling. Combine it with your zone export, and with active tools on your own domains.

For the site owner and for the developer

For the site owner (plain English)

Subdomain enumeration answers one question: “what websites and services carry our name on the internet right now?” You should be able to answer it from a list with an owner next to each line. If you can't, run the finder on your domain, give every name an owner or a retirement date, and ask whoever manages DNS to delete the dangling and dead ones. The whole exercise fits in an afternoon and removes more risk than most security purchases.

Enter your domain: the Subdomain Finder lists every name in certificate history and tells you which are live, third-party, dangling or gone — passively, in seconds.

Find your subdomains →

For the developer / IT (a passive baseline you can automate)

# 1. Names from CT
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//' | sort -u > ct.txt

# 2. Classify with DNS (CNAME first, then A/AAAA)
while read h; do
  c=$(dig +short CNAME "$h" | head -1); a=$(dig +short A "$h" | head -1)
  if [ -n "$c" ] && [ -z "$a" ]; then s="DANGLING?"; elif [ -n "$c" ]; then s="CNAME"; elif [ -n "$a" ]; then s="LIVE"; else s="UNRESOLVED"; fi
  printf "%-40s %-10s %s\n" "$h" "$s" "${c:-$a}"
done < ct.txt

# 3. Diff against last month's run — the diff is your change report
# 4. Only on domains you own: add active coverage
subfinder -d example.com -all -silent | sort -u > active.txt   # passive sources, many of them
comm -13 ct.txt active.txt                                       # names CT didn't know about

Store the classified list next to your code with an owner column; it is the input to the reduction checklist and the baseline that monitoring diffs against.

Subdomain Enumeration: How to Find All Subdomains of a Domain (Passively First)