Discover Public Subdomains of Any Domain
Find publicly known subdomains and associated IP addresses for security research, infrastructure mapping and domain analysis.
- Publicly discoverable hostnames
- Associated IP addresses when available
- Privacy-aware results
- Free to use
What Is a Subdomain?
Subdomains are extensions of your main domain that host separate sections of a website.
Extensions of a Domain
A subdomain sits before the main domain — like blog.example.com or shop.example.com. Each subdomain is a distinct DNS record that can host different content, services, or infrastructure.
How Discovery Works
Publicly known subdomains can be discovered from external data sources such as DNS-related records and certificate transparency data. This tool uses HackerTarget's Host Search API to retrieve its results.
Public vs Private
Only subdomains that are publicly discoverable through the tool's data sources can appear in the results. Internal, staging or private subdomains that are not in DNS or certificate logs remain hidden from external discovery tools.
Why It Matters
Subdomain discovery is essential for security auditing (finding forgotten or publicly exposed subdomains), competitive research (understanding a competitor's infrastructure), and infrastructure mapping (cataloguing all parts of a domain).
Subdomain Checker
Enter a domain name only (e.g., example.com). Full URLs are trimmed to the domain automatically.
Privacy note: your domain query is sent to a subdomain discovery service to fetch publicly available records. We do not store your searches after the request completes.
Understanding the Output
Each discovered hostname is shown with its associated IP address when available.
Subdomain Name
The fully qualified subdomain discovered — e.g., blog.example.com — ready to visit or investigate further.
IP Address
The IPv4 address associated with the subdomain when available, revealing where that subdomain may be hosted.
Copy One or All
Copy a single subdomain with its inline button, or copy the entire list to your clipboard with one click.
Download as TXT
Download the complete list of discovered hostnames as a text file for local review and import.
Honest by Design — What This Tool Does and Doesn't Do
This tool uses HackerTarget's Host Search API to find known hostnames and associated IP addresses. Results may not include every subdomain:
- ✓ Discovers publicly known subdomains with associated IP addresses when available.
- ✓ Lets you copy individual results, copy the full list, or download as a text file.
- ✓ Does not reveal private or internal subdomains that are not publicly discoverable.
- ✓ Does not guarantee complete subdomain coverage — some subdomains may not be indexed.
- ✓ Does not store your searches after the request completes.
This tool does
- Discover publicly known subdomains of any domain
- Show the associated IP for each subdomain when available
- Copy single subdomains, copy full list or export to TXT
- Work for any public domain, free
This tool does not
- Reveal private or internal-only subdomains
- Guarantee complete subdomain coverage
- Perform active port scanning or vulnerability tests
- Store your search history
- Require signup or payment
Want to Discover Publicly Known Subdomains of a Website?
A practical guide explaining how subdomain discovery works, how public DNS and certificate transparency data can help identify subdomains, and why subdomain discovery is useful for SEO, security, and website management.
📘 Read Full Subdomain Finder Guide →How to Use This Subdomain Checker
Four steps from entering a domain to a list of discovered subdomains.
Enter Domain
Type the domain name you want to analyze (e.g., example.com).
Click Find Subdomains
Press the button to query the discovery service.
Review the List
See each discovered subdomain with its associated IP address in a scrollable list.
Copy or Export
Copy individual results, get the complete list, or download hostnames as a TXT file.
Common Issues and What They Mean
If a search returns unexpected results, here's what's happening.
No Subdomains Found
0 RESULTSThe service returned no subdomains.
Solution: The domain may have no public subdomains, or the subdomains may not be indexed. Check the domain spelling and try again.
Invalid Domain Format
INPUTThe input contains invalid characters.
Solution: Enter a bare domain like example.com. Avoid spaces, protocols and paths.
Rate Limit Reached
LIMITYou've hit the hourly or daily search cap.
Solution: Wait a while for the rate-limit window to reset, then try again.
Service Unavailable
UPSTREAMThe upstream discovery service did not respond.
Solution: Try again in a few minutes. Upstream services occasionally have intermittent availability.
IP Shows "N/A"
PARTIALThe subdomain was found but the IP could not be resolved.
Solution: An IP address was not provided by the upstream directory database for this host.
Connection Failed
NETWORKOur server could not reach the discovery service.
Solution: Check your internet connection and try again in a moment.
When to Use This Subdomain Checker
Use the checker for these common scenarios.
Subdomain Checker FAQs
Answers based strictly on what this tool does and how subdomain discovery works.
How accurate is the subdomain discovery?
The tool uses HackerTarget's Host Search API which searches collected passive host and DNS datasets. While comprehensive, no passive tool can guarantee complete coverage — private or internal subdomains that are not publicly discoverable through the available data sources will not appear.
Is this tool free to use?
Yes, it is free to use. Fair-use rate limits help control traffic and prevent abuse. The upstream service may also enforce its own limits.
How many domains can I check at once?
One domain at a time. The tool returns all discovered subdomains for that specific domain. For bulk checking, run multiple individual searches.
What if no subdomains are found?
It could mean the domain has no public subdomains, the domain does not exist, or the subdomains are not indexed in public sources. Try checking the spelling and ensure it is a valid domain.
Can I use this for commercial purposes?
Yes, for legitimate commercial purposes such as security auditing, competitive analysis and infrastructure mapping. Ensure you comply with applicable laws and the target domain's terms of service.
What is certificate transparency?
Certificate Transparency is a public log of all SSL/TLS certificates issued by trusted CAs. Because certificates often cover subdomains, these logs are a rich source for subdomain discovery.
Does the tool scan or attack the domain?
No. It only queries database records of publicly available DNS and certificate data — no active scanning, port probing or exploitation is performed.
Why are rate limits in place?
Subdomain discovery queries the upstream service, which has usage caps. Rate limits keep the tool available for all users and prevent abuse of the upstream service.