Subdomain Finder
Find subdomains from public SSL certificate logs and check which of them still resolve in DNS. Passive: we never contact the hosts themselves.
What this search can and cannot see
- Only names that received a public SSL certificate: certificate authorities must log every certificate in Certificate Transparency logs. Internal names without a certificate and subdomains without HTTPS do not show up.
- A wildcard certificate (*.example.com) hides the actual names: subdomains served under it appear only as "*".
- Logs keep old certificates too, so the list includes names that are long gone — that is what the DNS column is for.
- The search is passive: no wordlist guessing, no port scanning, no visiting the hosts found. DNS answers come from Cloudflare's and Google's public resolvers, up to 300 names per check.
Found forgotten subdomains? Check what runs on them
Old test and service subdomains often run outdated CMSs nobody updates. PromoPilot Shield checks a site from the outside: security headers, TLS and the certificate, exposed .git/.env and backups, CMS vulnerabilities, SPF/DKIM/DMARC/CAA. Add each important subdomain as its own site. Monitoring from $12/month: scheduled rescans and alerts about new threats and certificate expiry.
Free website scan About ShieldKey facts
- Price
- Free
- Sign-up
- Not required
- Processing
- On our server: names from Certificate Transparency logs (crt.sh, with Cert Spotter as a fallback); DNS via Cloudflare's and Google's public DNS-over-HTTPS resolvers
- Input
- One domain, e.g. example.com (a leading www. is dropped)
- Limits
- 6 searches per minute; 15 a day without an account, 45 with a free account, unlimited with Pro; name lists cached for 24 hours; up to 300 names resolved per search
- Output
- Subdomains with DNS status (resolves / no record / dangling CNAME), IPs or CNAME chain, CDN or service, and newest certificate expiry; filter and CSV export
- Last updated
Alternatives
Other tools for the same job, and what each one does well:
- crt.sh — Searches Certificate Transparency logs with the full certificate history, expired ones included; it does not check DNS and often returns 502 errors or times out under load.
- DNSDumpster — A free DNS recon service that discovers hosts related to a domain; paid membership and an API are available.
- Pentest-Tools Subdomain Finder — Combines passive sources (certificate logs, search engines) with active DNS brute forcing and validates names in real time; a light version is free, the full one is paid.
- subfinder (ProjectDiscovery) — An open-source command-line tool for fast passive subdomain enumeration across many sources; some sources need your own API keys.
When to choose this tool: When you want a quick passive list with no install or sign-up, already checked against DNS with dangling CNAMEs and Cloudflare/CDN hints — in English, Russian, Ukrainian or Polish.
Descriptions checked against each tool's own site in October 2026.
Find subdomains from Certificate Transparency logs
This subdomain finder is passive: names come from public Certificate Transparency logs (crt.sh, or Cert Spotter when crt.sh is down), are cleaned of "*." and duplicates, and up to 300 of them are checked in DNS — which resolve, where CNAMEs point and which CNAMEs dangle on a target that no longer exists. Nothing is sent to the hosts themselves: no wordlist brute force, no port scan, no page visits. Free, no sign-up — 15 searches a day, 45 with a free account.
How to Use
- Enter a domain, e.g. example.com
- The first search takes up to 30–40 seconds; after that the name list is cached for a day
- Filter by status, export CSV and remove dangling CNAMEs
FAQ
Where the subdomains come from
Certificate authorities must log every public SSL certificate in Certificate Transparency (CT) logs, which anyone can read. A certificate lists the names it was issued for, so CT logs effectively hold the history of every name of a domain that ever had HTTPS: mail.example.com, staging.example.com, old-shop.example.com.
This tool reads those names from crt.sh (the full history, expired certificates included) or, when crt.sh does not answer, from Cert Spotter (currently valid certificates only). It removes duplicates and "*.", keeps only the domain and its subdomains, and checks up to 300 names in DNS.
Reading the results
| Status | Meaning | What to do |
|---|---|---|
| resolves | The name resolves to IPv4 or IPv6 (directly or via CNAME) | Make sure you still need it and keep it updated |
| no DNS record | NXDOMAIN — the name is gone; only an old certificate remains | Nothing, it is history |
| no A/AAAA | The name exists but has no address (e.g. only MX or TXT) | Usually fine |
| dangling CNAME | The CNAME points to a name that does not exist | Delete the CNAME or reclaim the resource at the provider |
"Cert valid to" is the expiry of the newest certificate carrying that name. Grey dates in the past mean no certificate has been issued for the name in a while.
Dangling CNAMEs and subdomain takeover
A typical story: promo.example.com was a CNAME to example-promo.herokuapp.com for a campaign; the app was deleted but the DNS record stayed. If the provider lets anyone create an app, bucket or page with that name, an attacker can claim it and serve their own page on your subdomain — with your domain in the address bar. That is a subdomain takeover.
We flag such records and name the service when it is one where this is known to be possible (S3, Azure, Heroku, GitHub Pages, Netlify, Shopify and others). We never contact the hosts, though, so only the provider's dashboard can confirm the risk. The simplest fix is to delete the unused CNAME.
What certificate logs cannot show
- Names behind a wildcard certificate. If subdomains run under
*.example.com, the log only shows "*". The tool tells you when it finds such certificates. - Names without HTTPS and internal names using a private CA.
- Wildcard DNS. If every subdomain answers (a
*.example.comDNS record), "resolves" proves nothing — we test a random name and mark matching rows with an asterisk.
Only the owner's DNS panel has the complete list. Wordlist brute forcing finds more, but it is active scanning — run it only against domains you own.
What to do with the findings
- Export the CSV and mark subdomains you did not know about.
- Delete dangling CNAMEs and records of old test environments.
- Put live internal subdomains (admin panels, staging) behind authentication or an IP allowlist and keep their CMS updated.
- Run important subdomains through the website security scanner and the SSL checker.