Subdomain checker
Find publicly known subdomains of any domain from Certificate Transparency logs and DNS data, then see which ones are live today, which point to other services and which CNAMEs lead nowhere.
- Two passive sources, merged
- Live DNS check of each name
- No scanning, no signup
Subdomains found
—
- DomainWaiting for inputWhat you entered
- Sources—CT logs and DNS data
- Merged—Unique names
- Live DNS—Checked today
Subdomain report
Enter a domain above to see its publicly known subdomains, where each was found, and whether it is live, a CNAME alias or gone today.
Fair-use limit: 10 new lookups per hour and 30 per day for each visitor IP address. Results are cached for 12 hours.
How public subdomains become visible
Subdomains are not secret by design. Several public systems record them, and that is where this tool looks.
Every certificate is logged
Browsers only trust HTTPS certificates that are published in Certificate Transparency logs. Each certificate lists the names it covers, so shop.example.com becomes public the day it gets a certificate.
DNS data is collected too
Services like HackerTarget record host names seen in DNS answers and scans of the internet, together with the IP address they had.
Logs remember old names
A subdomain retired years ago still shows in certificate logs. That is why the live DNS check matters: it separates today's hosts from history.
Forgotten names are a risk
Old test servers and CNAMEs pointing to cancelled cloud services are common ways sites get compromised. Reviewing this list is a cheap first audit.
The data sources and their limits
What each source contributes, and what it can never show.
| Source | What it is | It finds | It misses |
|---|---|---|---|
| Certificate Transparency (crt.sh) | Public logs of every certificate issued by trusted authorities | Names that ever had an HTTPS certificate, including old ones | Names only covered by *.example.com wildcards |
| HackerTarget host search | DNS records collected from scans and passive data | Names with their IP address at the time they were seen | Names not seen in their data, and it allows about 50 free queries a day |
| Live DNS check (Google Public DNS) | A fresh lookup of each name found, up to 150 | Which names resolve today and which are CNAME aliases | It confirms names, it never finds new ones |
How this tool works
What happens between pressing Find and seeing the list.
You enter a domain
For example example.com or shop.example.com. Pasted links are trimmed to the host name.
Two public sources are asked
Our server asks crt.sh and HackerTarget at the same time. The domain itself is never contacted.
Names are merged and cleaned
Wildcards, duplicates, email addresses and names outside the domain are removed, and each name keeps where it was seen.
Each name is checked in DNS
Up to 150 names are looked up live, showing Live, CNAME or No DNS, and flagging CNAMEs that lead nowhere.
What this tool does, and what it doesn't
A plain list, so you know exactly what to expect.
This tool does
- Combine certificate logs and DNS data
- Show where each name was found
- Check up to 150 names live in DNS
- Flag CNAMEs that lead nowhere
- Detect wildcard DNS
- Export names, status and IPs as CSV
This tool does not
- Find every subdomain that exists
- Brute-force or guess names
- Scan ports or test for weaknesses
- Contact the domain's servers
- Confirm a takeover is possible
- Keep results longer than 12 hours
Where your data goes
The domain you enter is sent from our server to crt.sh (run by Sectigo) and HackerTarget, and the names they return are looked up with Google Public DNS. They see our server, not you, and the domain itself is not contacted. The result is cached for 12 hours, then deleted. A hashed, temporary copy of your IP address is used for rate limiting. Like any website, our server may keep normal access logs, as described in our privacy policy.
Step-by-step guide by Bhavin J. Sheth.
Why your results might look unexpected
The six surprises people run into most, and what each one means.
No subdomains found
The domain may be new, use only a wildcard certificate, or have no public subdomains. Check the spelling and try the main domain.
A source was busy
crt.sh is often slow and HackerTarget has a daily free limit. The report shows which source answered. Try again later.
Many names show No DNS
Certificate logs keep names forever, so retired subdomains still appear. That is normal history, not an error.
Dangling CNAME flagged
The name points to a service that does not answer. If you own the domain, remove the record or reclaim the service.
Every name resolves
The domain may use wildcard DNS, which answers for any name. The report shows when a made-up name also resolves.
Internal names appear
Names like vpn or staging in public certificates are visible to everyone. Consider wildcard certificates for internal hosts.
Questions about finding subdomains
Where do the subdomains come from?
From two public, passive sources: Certificate Transparency logs, which record every HTTPS certificate issued by trusted authorities and the names on it, and HackerTarget's host search, which collects DNS data. The tool never scans, guesses or brute-forces names, and the domain itself is not contacted.
Why are some subdomains missing?
Only names that appeared in a public certificate or in HackerTarget's DNS data can be found. Internal names, names covered only by a wildcard certificate such as *.example.com, and new subdomains that were never seen publicly will not appear. No passive tool finds everything.
What do Live, No DNS and CNAME mean?
After collecting the names, the tool asks Google Public DNS about each one, up to 150 names. Live means it has an address right now. No DNS means it no longer exists or has no address. CNAME means it points to another name, often a hosting, CDN or SaaS service.
What is a dangling CNAME?
A subdomain whose CNAME still points to a service, such as a cloud app or storage bucket, that no longer exists. If someone else can claim that service name, they could serve content on your subdomain. The tool flags these as possible risks to check, not as confirmed problems.
Is it legal and safe to look up subdomains?
The tool only reads public records that anyone can query, so looking up a domain is normally fine. What you do with the results is your responsibility: only test or probe systems you own or have written permission to test.
Why are there limits?
Both data sources are free public services. HackerTarget allows about 50 free queries a day for our whole server and crt.sh is often slow under load, so results are cached for 12 hours and each visitor can run 10 new lookups per hour. When a source is busy, the report says so.
Is the domain I check stored?
The domain is sent from our server to crt.sh and HackerTarget, and the names found are checked with Google Public DNS. The result is cached on our server for 12 hours so repeated lookups do not hit those services again, then deleted. A hashed, temporary copy of your IP address is used for rate limiting. Like any website, our server may keep normal access logs, as described in our privacy policy.