Subdomain Finder
List every subdomain of a domain from public Certificate Transparency logs, see which ones are live, which point at third-party platforms, and which are dangling — passively, in seconds, no signup.
This tool reads public Certificate Transparency logs and DNS. It never connects to any discovered host. Enumerate only domains you own or are authorized to assess.
How does this subdomain finder work?
Every publicly trusted TLS certificate is recorded in Certificate Transparency (CT) logs, so the set of names that ever had HTTPS under a domain is public. The finder queries crt.sh (with Cert Spotter as a fallback) for every name under the domain's registrable apex, removes duplicates and wildcards, and returns up to 300 of them.
Each name is then classified with plain DNS: live (resolves to an address), CNAME (points at another name — flagged as third-party when that name belongs to a different domain), dangling (a CNAME whose target no longer resolves, the pre-condition for a subdomain takeover) or unresolved (the name is in certificate history but no longer exists).
Because it is passive, it also shows what an attacker's first reconnaissance step sees: forgotten staging hosts, old microsites and platform integrations you stopped paying for. Hosts that only ever used a wildcard certificate or never had HTTPS will not appear.
What to do with the list
Treat it as an inventory pass — the first step of attack surface management:
- Dangling CNAMEs: verify the target, then delete or re-point the record before someone claims it.
- Unresolved names: nothing to do unless one should still exist — that's a DNS problem, not a security one.
- Third-party hosts: keep them in your inventory and confirm each still points at a service you actually use.
- Live hosts you don't recognise: find the owner or retire them; then score the ones you keep.
Common SSL problems and where to fix them
- Subdomain takeover via dangling DNS — how it happens and how to fix it →
- Subdomain enumeration: every passive source explained →
- Certificate Transparency logs — what they reveal and how to search them →
- subfinder, amass, crt.sh and friends compared →
- Map your whole attack surface in an afternoon →
New to SSL/TLS errors? Start with the complete guide to SSL/TLS errors →
Frequently asked questions
Is this subdomain finder free?
Yes — free, no account, no email. Enter a domain and get the list with DNS status immediately. Results are shown to you only and are never stored or indexed.
Does it scan the target?
No. Names come from public Certificate Transparency logs (crt.sh, Cert Spotter) and classification uses DNS lookups against the resolver. The tool never sends a request to any discovered hostname, so it is safe and legal to run on any domain you own or are assessing with permission.
Why are some of my subdomains missing?
Certificate Transparency only records names that appeared on a publicly trusted certificate. Hosts covered by a wildcard certificate, internal hosts with a private CA, and hosts that never had HTTPS are invisible to CT. For those you need your DNS zone export or an active enumeration tool run against your own domain.
What does 'dangling' mean and is it serious?
A dangling record is a CNAME whose target no longer resolves — typically a SaaS or cloud resource you decommissioned while leaving the DNS record in place. If the provider lets anyone claim that target name again, an attacker can serve content under your hostname (a subdomain takeover). CT and DNS can show the pre-condition but not confirm exploitability, so the finder reports it as LOW with 'verify' wording. The fix is one DNS change.
How is this different from subfinder or amass?
Those are excellent open-source enumeration tools that combine many sources, including active DNS brute-forcing, and are meant to be run from a terminal against domains you own. This finder uses one passive source, needs no install, adds the DNS classification and owner-facing explanations, and links each situation to a fix guide. Use it for a first pass or a client conversation; use the CLI tools when you need maximum coverage.