▸ Free subdomain finder
Search every hostname seen in Certificate Transparency. List all subdomains of one domain, or match a substring across every TLD.
Enter a domain to list its subdomains, or switch to contains for a substring search.
A subdomain finder answers one question: which hostnames exist under a domain. Type example.com and every fully-qualified hostname we have seen under it comes back - mail.example.com, vpn.example.com, staging.api.example.com - out of 1,490,626 hostnames under 288,919 domains.
The second mode is a substring subdomain search: type grafana and you get every hostname containing it, in any domain and any TLD. Both read the same index of names observed in public Certificate Transparency logs, so every row is a hostname a certificate authority actually issued for.
▸ How subdomain search works
- ▸ Subdomains of a domain
- Enter a registrable domain such as
example.comand the whole namespace under it comes back, sorted. Hostnames are stored reversed, so this is a key range rather than a scan and stays fast however large the table gets. - ▸ Substring match
- The contains mode matches your term anywhere in the hostname, dots included, so
api.stagefindsapi.stage.example.com. Case is ignored. - ▸ Three characters minimum
- The substring index is built on three-character grams. A shorter term cannot use it and would read the whole table, so the minimum is refused at the server rather than quietly accepted.
- ▸ Depth filter
- Depth counts labels below the registrable domain:
mail.example.comis 1,a.b.example.comis 2. Capping it hides the deep autogenerated hosts that ACME validation and CDNs leave behind. - ▸ Common name and issuer
- Each row carries the Common Name of the certificate the hostname was found on and the authority that issued it. One certificate has one common name and many alternative names, so the common name repeats across hostnames that shared a certificate.
- ▸ The same query over HTTP
GET /api/v1/subdomains/search?domain=example.comreturns the same rows as JSON, with the sametldandmax_deptharguments. There is an MCP tool for the same data.
▸ Example subdomain searches
| query | what it returns |
|---|---|
| Mail infrastructure: mail, webmail, mail-eu, smtp-mail. | |
| vpn | Remote-access hosts, usually the first thing an attacker looks for. |
| staging | Pre-production environments that were never meant to be public. |
| grafana | A named tool given a hostname of its own. |
| api.stage | A dotted term is matched as written, so this finds api.stage.example.com. |
| internal | Hosts named as private that hold a publicly trusted certificate anyway. |
These run in contains mode. To list one namespace instead, switch to subdomains of and enter a registrable domain such as example.com.
▸ What a subdomain finder is good for
Attack surface review
Certificate Transparency is public, so anyone enumerating your subdomains is reading the same logs you can. Running the enumeration on your own domain tells you what they will find: forgotten staging hosts, admin panels, an old VPN concentrator still holding a certificate.
Shadow IT discovery
A team that put a certificate on a hostname put that hostname in a public log, whether or not anyone told IT. Listing everything under your domain surfaces the services nobody registered with you.
Bug bounty and pentest scoping
Scope usually arrives as a domain. This turns it into a hostname list in one query, with first-seen dates, so a host that appeared last week reads differently from one that has been there for years.
Infrastructure hygiene
First seen and last seen say when a hostname entered the certificate record and when it was last renewed. A host that stopped renewing is usually a host somebody forgot.
▸ Where the hostnames come from
One source: Certificate Transparency. Every publicly trusted certificate authority must publish each certificate it issues to append-only public logs, and each certificate names the hostnames it covers in its Common Name and Subject Alternative Name fields. We read those logs continuously and keep every hostname.
That is what separates this from a wordlist scanner. A brute-force tool guesses names and asks DNS whether the guess resolves, so it only ever finds names somebody thought to guess. A certificate log is a record of names that were actually provisioned, including the ones no wordlist contains.
- ▸ 1,490,626 hostnames under 288,919 domains across 1,260 TLDs, growing continuously
- ▸ a certificate issued this morning is searchable within minutes
- ▸ wildcard certificates are kept with a literal * label, as evidence the namespace is in use
▸ What this is not
- Not a DNS resolver. A hostname listed here had a certificate issued for it. It does not follow that it resolves today, that anything is listening on it, or that it was ever reachable from the public internet.
- Not complete. A subdomain with no publicly trusted certificate - internal-only names, self-signed hosts, anything behind a private CA - never reaches a transparency log, so it is not here. No certificate-based tool can see those.
- Not a full history, yet. This index holds hostnames captured from the live certificate logs onward rather than the whole archive of Certificate Transparency, so coverage of any single domain deepens as its certificates are renewed.
▸ Frequently asked questions
? How do I find all the subdomains of a domain?
Pick subdomains of, type the registrable domain such as example.com, and press enter. Every hostname we have seen under it comes back sorted, with the certificate common name, the issuing authority and first and last seen dates, out of 1,490,626 hostnames indexed. No account is needed.
? Is this subdomain finder free?
Yes. The page is free and needs no account. The same search over HTTP, at /api/v1/subdomains/search, takes a free API key, which is what keeps automated use attributable and rate-limited.
? How is this different from a subdomain enumeration tool?
A brute-force enumerator guesses hostnames from a wordlist and asks DNS about each guess. This reads Certificate Transparency, a public record of names certificate authorities actually issued for, so it surfaces names no wordlist contains. The trade is the reverse one: it cannot see a host that never had a public certificate.
? Why does the search need at least three characters?
The substring index is built on three-character grams, so a one- or two-character term matches nothing in it and the query falls back to reading every row of a table designed to hold billions. The minimum is enforced by the server, not just the browser.
? What does the common name column mean?
It is the Common Name field of the certificate the hostname was found on. A certificate carries one common name and up to hundreds of alternative names, so the same value repeats across every hostname that shared that certificate. It tells you which certificate a host came from.
? Are wildcard subdomains included?
Yes. A certificate for *.example.com is stored with a literal * label and appears in the list. It is evidence that the namespace is in use without naming a specific host, which is exactly what that certificate says and no more.
? Can I run a subdomain search from a script?
Yes. GET /api/v1/subdomains/search takes domain or q, plus tld and max_depth, and answers JSON with the same fields as the table. There is an MCP server as well, so an AI assistant can run the query directly.
? How current is the data?
The certificate logs are read continuously, so a hostname is usually searchable within minutes of its certificate being issued. Coverage reaches forward from the day capture started rather than back through the whole archive, so it deepens for any given domain as its certificates renew.