Free Subdomain Finder

A subdomain finder is a tool that discovers all subdomains belonging to a domain. For example, given example.com, it finds api.example.com, mail.example.com, blog.example.com, dev.example.com, every named subdomain that has been used publicly. SEO teams use subdomain finders to audit competitor infrastructure, find their own forgotten subdomains, and discover content opportunities. Security teams use them to map attack surfaces.

We query Certificate Transparency (CT) logs via crt.sh. CT is a public, append-only log of every SSL/TLS certificate ever issued by trusted certificate authorities. When a site issues an HTTPS certificate for a subdomain (which every modern site does), that subdomain becomes publicly discoverable in CT logs forever. This method finds significantly more subdomains than DNS brute-forcing because it captures certificates issued years ago, even if the subdomain is no longer active.

Certificate Transparency (CT) is a Google-led standard that requires every SSL/TLS certificate issued by trusted CAs (Let's Encrypt, DigiCert, Sectigo, etc.) to be logged in public, tamper-proof logs. CT was created to detect mis-issued certificates. A side effect: every subdomain that ever obtained a certificate is permanently visible in CT logs. There's no way to opt out, if you want HTTPS, your subdomain shows up. This is why CT is the most reliable subdomain discovery method.

Almost all that have used HTTPS publicly. CT logs cover every certificate issued by trusted CAs since 2018 (mandatory) and most before that. Subdomains that never obtained a public SSL cert (internal-only, IP-based, self-signed) won't appear. For internal subdomains, you'd need DNS brute-forcing or zone transfers. For 99% of public-facing subdomains, CT log scanning catches them.

Yes, this is one of the highest-value use cases. Competitor subdomain audits reveal: hidden product lines (app.competitor.com), staging/dev environments accidentally exposed (staging.competitor.com), regional domains (uk.competitor.com), partner integrations (partners.competitor.com), and internal tools (admin.competitor.com). All public information from CT logs, no hacking, no privacy violations. Just public certificate data.

Subdomains are treated as separate sites by Google for ranking purposes, each accumulates its own link equity, page authority, and topical relevance. Multi-subdomain strategies can dilute your domain's overall authority (PageRank gets split). For SEO audits: identify orphan subdomains (no incoming links), redirect dead subdomains to consolidate authority, ensure each active subdomain has its own sitemap.xml and robots.txt. Subdomain hygiene is foundational technical SEO.

A subdomain (blog.example.com) is technically a separate hostname, treated by search engines as a distinct site. A subdirectory (example.com/blog) lives within the main domain and inherits its authority. Generally, subdirectories are better for SEO because all link equity consolidates under one domain. Use subdomains when content is genuinely separate (different language sites, internal apps, distinct products), not for blog/docs that should benefit from main domain authority.

Yes, if Google can find them. Google discovers subdomains via: links from other indexed pages, sitemap submissions in Search Console, public DNS records (less reliable), and Certificate Transparency logs (Google operates several CT logs). To prevent indexing of a subdomain, use robots.txt or noindex meta tags. To verify what Google has indexed for a subdomain, use the site:subdomain.example.com search operator.

Run this tool against your domain. Compare the result against your active subdomain list. Anything in the CT-discovered list that you don't recognize is a forgotten subdomain, common sources: old marketing campaigns (campaign-2022.example.com), retired internal tools (legacy-admin.example.com), abandoned A/B tests (test1.example.com). Decide whether to: (1) reactivate if useful, (2) 301 redirect to the main site, or (3) take down the DNS record entirely to remove from CT.

Yes, subdomain enumeration is a standard reconnaissance technique in penetration testing and bug bounties. Public subdomain data is available to attackers regardless of whether you use this tool. The defensive answer: assume your subdomains are discoverable, and harden each one. Audit publicly-exposed subdomains for forgotten dev/staging environments, default credentials, and outdated software. The same tool security pros use, defenders should use first.

Certificate Transparency logs are append-only and historical, once a certificate is issued for a subdomain, it stays in CT logs forever, even after the subdomain is decommissioned. That's why you may see subdomains like old-2019-campaign.example.com that no longer resolve. This is actually useful: it shows the historical infrastructure of a domain, helping audit what was once exposed. To verify if a subdomain is currently active, do a DNS lookup or HTTP check after discovery.

No. Domain queries are forwarded to the public Certificate Transparency database (crt.sh) and the result is returned to you, nothing is logged or persisted on our servers. The optional history feature uses your browser's localStorage only. Safe to audit competitor domains, client domains, or your own staging infrastructure without any data retention concerns.