Subdomain Finder
Enter a domain and see every subdomain that sits on a currently valid TLS certificate. Every public certificate is written to Certificate Transparency logs, so the names a company secures (vpn, mail, staging, the admin panel someone forgot) are public record. Your browser asks the log search directly; the domain is not sent to us.
The app finds subdomains the other way round: it asks DNS about four hundred common names (vpn, mail, dev, admin and so on) and reports the ones that resolve, which catches hosts that have never had a public certificate. It detects wildcard DNS so it does not report every guess as real, and Port Scan and TLS Inspect in the same app are there to look at whatever it finds.
How a subdomain finder works
There are two ways to find the subdomains of a domain from the outside. The first is to read Certificate Transparency: since 2018 every publicly trusted TLS certificate must be logged in append-only public logs before browsers accept it, and each certificate lists the names it covers. Anyone can search those logs, which is what this page does. The second is to guess: ask DNS whether vpn.example.com, mail.example.com, dev.example.com and a few hundred other likely names exist. Certificates find names nobody would guess; guessing finds names that never had a certificate. A thorough review uses both.
Why it matters for security
Attackers start here. The subdomains a company exposes are its attack surface: the VPN gateway, the webmail, the Jenkins server, the staging copy of the site with the debug mode still on. Forgotten subdomains are the classic way in, because nobody patches what nobody remembers. If you look after a domain, list its subdomains every few months and check that each one still has an owner.
What this search cannot see
Names only covered by a wildcard certificate (*.example.com) never appear individually. Hosts using certificates from a private certificate authority, internal-only hosts and anything without TLS are invisible to Certificate Transparency. This page shows certificates that are still valid; for the full history, including names that have since been retired, search crt.sh. And a name on a certificate is not proof a host is live today. Resolve it to find out.
How to find subdomains on your laptop
For the full certificate history: curl -s "https://crt.sh/?q=%25.example.com&output=json" piped to jq -r '.[].name_value' | sort -u. For a combined search across many public sources, the open-source subfinder (subfinder -d example.com) and amass (amass enum -passive -d example.com) are the standard tools. To check which of the names still resolve, feed the list to dnsx or simply dig +short each one.
Is it legal to look up subdomains?
Reading Certificate Transparency logs and public DNS is reading public records, the same data every browser and certificate monitor uses. Scanning or attacking the hosts you find is a different matter and needs the owner's permission.