How to find subdomains of a domain
Enter a domain name such as example.com and press Find subdomains. The subdomain finder then uses two public sources:
1. Certificate transparency logs
Every publicly trusted TLS/SSL certificate is recorded in public certificate transparency (CT) logs. Host names that ever received a certificate, such as shop.example.com or api.example.com, can be found there — often including names that are not linked from any website.
2. DNS lookup of common names
We also check about 55 frequently used subdomains — www, mail, api, dev, staging, shop, cdn, vpn and more — in public DNS. Wildcard records are detected so you do not get false positives.
3. Public IP addresses
Each subdomain that exists in DNS is shown with its public IPv4 address. Private and internal addresses are never displayed. Results come from public data only and are not stored.
Why get a list of subdomains?
- Know your attack surface: forgotten test, staging or old campaign subdomains are a common security risk.
- Asset inventory: see which services run under your domain before a migration, rebranding or DNS change.
- Email and DNS hygiene: spot old mail servers and dangling records that still point to services you no longer use.
- SEO: find duplicate or staging sites that search engines might index next to your main website.
This is a lightweight, privacy-friendly lookup: it does not scan ports and never connects to the subdomains it finds.
Subdomeinen van een domein vinden
Met deze gratis subdomeinzoeker vindt u in een paar seconden de subdomeinen van een domeinnaam. De tool doorzoekt openbare certificate-transparency-logboeken en controleert veelgebruikte namen zoals www, mail en api in DNS. Handig om te zien welke websites en diensten er onder uw domein draaien, bijvoorbeeld vóór een verhuizing of een beveiligingscontrole.
Frequently asked questions
What is a subdomain finder?
A subdomain finder lists the subdomains that belong to a domain, such as www.example.com, mail.example.com or shop.example.com. It helps you see which host names exist for a domain, for example to inventory your own websites and services or to prepare a migration.
How does this tool find subdomains?
It combines two public sources. First it searches certificate transparency logs: every publicly trusted TLS certificate is logged, so host names that ever had a certificate show up there. Second it checks a fixed list of about 50 common names (www, mail, api, dev, staging and more) in public DNS. Found names are resolved to their public IPv4 addresses.
Is the subdomain finder free? Do I need an account?
Yes, it is free and you do not need an account. To keep the service fast for everyone there is a limit of 10 lookups per hour per connection.
Why do some subdomains have no IP address?
A name can appear in certificate logs but no longer exist in DNS, or it only points to an internal network. Internal and private IP addresses are never shown. For large domains only the first 150 names are resolved.
Does the tool scan ports or visit the websites it finds?
No. This version only reads certificate transparency logs and performs normal DNS lookups. It does not scan ports, does not connect to the hosts it finds and does not store your results.
Can this tool find every subdomain of a domain?
No method can guarantee a complete list. Subdomains that never had a public certificate and are not in the list of common names will not appear, and a wildcard DNS record can hide individual names.
Is it legal to look up subdomains?
Certificate transparency logs and DNS records are public by design, so looking them up is generally fine. Only use the results responsibly and do not test or attack systems you do not own or have permission to test.
Need help with your domain, DNS or website?
IT Live is a Dutch provider of AI hosting, websites and IT services.