Subdomain Finder — Discover a Domain's Subdomains Free
Whether you're auditing your own attack surface or mapping out a domain, finding every subdomain by hand is impossible. There's no single DNS query that lists them — you need a smarter source.
Our Subdomain Finder discovers subdomains from public Certificate Transparency logs — the public record of every SSL certificate ever issued — and gives you a clean, exportable list in seconds.
How it works
Every time an SSL certificate is issued for a subdomain, it's logged publicly in Certificate Transparency logs. The Subdomain Finder searches those logs, filters out the noise, and returns the real subdomains for a domain — no brute-forcing, no guessing.
- Fast & passive — it reads public certificate logs, it doesn't hammer the target.
- Clean results — duplicates and invalid entries are filtered out automatically.
- Export to text — download the full list as a
.txtfile for your notes or tooling.
What it's good for
- Attack-surface mapping — see what subdomains of your own domain are publicly known.
- Recon & audits — quickly enumerate a domain you're authorised to assess.
- Inventory — find forgotten or stale subdomains you may have spun up and lost track of.
How to use it
- Go to the Subdomain Finder.
- Enter a domain name (e.g.
example.com). - Get the list of discovered subdomains — and download it as
.txt.
Good to know
Because it relies on Certificate Transparency, it finds subdomains that have had an SSL certificate issued — which covers most public ones, though it isn't guaranteed to be exhaustive. It's free, needs no sign-up, and only uses public data.
