How to Find All Subdomains of a Domain

Most organizations have more subdomains than anyone remembers. A staging server from a project that shipped two years ago, a one-off marketing microsite, an internal tool a former colleague spun up, an api. host nobody documented — they accumulate quietly, and each one is a live surface with a certificate that will eventually expire. Before you can secure or clean up what you own, you have to be able to see it. Here's how to find every subdomain of a domain, starting with the fastest method.

The fast way: Certificate Transparency logs

The single most effective passive technique is reading Certificate Transparency (CT) logs. Since 2018, browsers require every publicly-trusted SSL/TLS certificate to be recorded in these open, append-only logs — they exist so that mis-issued certificates can be caught. Crucially, each logged certificate lists every hostname it covers. So the moment someone gets a certificate for staging.example.com, that subdomain is announced, permanently, to anyone reading the logs.

That makes CT logs a near-complete, no-effort inventory of a domain's public subdomains. You don't touch the target at all — the data already sits in public logs.

The quickest way to query them is our free subdomain finder: enter a domain and it pulls the unique subdomain names from CT logs, then does a DNS lookup on each so you can see which are still live. No signup, nothing sent to the domain itself.

The other methods (and where they fall short)

CT logs won't be the only tool in a thorough audit, but the alternatives each have real limits:

• Search engines. The site:example.com operator surfaces subdomains a search engine has crawled. It's quick, but it only shows indexed, public pages — anything behind a login, unlinked, or noindex won't appear.
• DNS brute-forcing. Tools guess common names (www, mail, dev, vpn…) against a wordlist and keep the ones that resolve. This can find hosts that never got a public certificate, but it's active (you're sending traffic to the target), noisy, and it only finds names on your wordlist.
• DNS zone transfers (AXFR). If a nameserver is misconfigured to allow it, a zone transfer dumps every record at once. In practice almost every nameserver refuses this today, so it rarely works.
• Passive DNS / aggregators. Third-party services that have historically recorded DNS answers can reveal old hosts. Coverage varies and the good ones are usually paid.

For most people, CT logs plus a quick site: search cover the overwhelming majority of what's actually reachable — passively, and in seconds. If you need to be exhaustive (a security assessment), you'd layer brute-forcing and passive DNS on top.

What CT logs won't show

Be honest about the gaps, because they matter:

• Hosts that never had a public certificate. A purely internal service, or one behind a corporate proxy, may never appear.
• Wildcard certificates. A *.example.com certificate covers any host at that level without naming them, so the specific subdomains underneath it can stay invisible. (Our tool lists any wildcards it finds separately, as a signal that there may be more.)

What to do with the list

Finding the subdomains is step one. The list is only useful if you act on it:

1. Decommission what you don't need. Every forgotten host is attack surface and a certificate to maintain. Retire the ones that shouldn't exist, and make sure their DNS records go too, so you're not left with a dangling record pointing at a service you no longer control.
2. Check the certificates you're keeping. For anything still live, confirm the certificate isn't about to lapse — an expired certificate breaks that host instantly for every visitor. You can check any host with our free SSL certificate checker, and see the full DNS picture with the WHOIS & DNS lookup. (If you're not sure what an expired certificate actually does, see what happens when an SSL certificate expires.)
3. Watch for new ones. New subdomains and certificates appear all the time — sometimes ones you didn't authorize, which can be an early sign of a problem.

Why finding them once isn't enough

A subdomain audit is a snapshot. Tomorrow someone deploys a new service, a certificate gets reissued, or a name you retired quietly comes back. The point of CT logs isn't just a one-time list — it's that they update continuously, so you can be told when a new certificate is issued for your domain instead of finding out by accident.

That's what DomainChest does: add a domain once and it watches Certificate Transparency logs for new certificates on it and its subdomains, tracks each certificate's expiry alongside the domain registration, and emails you before anything lapses — or when something unexpected shows up. You can read more about that on the SSL & certificate monitoring page.

Start by listing your subdomains for free — then decide which ones are worth watching.