How to find subdomains of a domain
Enter a domain name such as example.com and press Find subdomains. The subdomain finder then uses two public sources:
1. Certificate transparency logs
Every publicly trusted TLS/SSL certificate is recorded in public certificate transparency (CT) logs. Host names that ever received a certificate, such as shop.example.com or api.example.com, can be found there — often including names that are not linked from any website.
2. DNS lookup of common names
We also check about 55 frequently used subdomains — www, mail, api, dev, staging, shop, cdn, vpn and more — in public DNS. Wildcard records are detected so you do not get false positives.
3. Public IP addresses
Each subdomain that exists in DNS is shown with its public IPv4 address. Private and internal addresses are never displayed. Results come from public data only and are not stored.
Why get a list of subdomains?
- Know your attack surface: forgotten test, staging or old campaign subdomains are a common security risk.
- Asset inventory: see which services run under your domain before a migration, rebranding or DNS change.
- Email and DNS hygiene: spot old mail servers and dangling records that still point to services you no longer use.
- SEO: find duplicate or staging sites that search engines might index next to your main website.
This is a lightweight, privacy-friendly lookup: it does not scan ports and never connects to the subdomains it finds.
What is a subdomain?
A subdomain is a name in front of a registered domain: in shop.example.com the domain is example.com and shop is the subdomain. The owner of the domain can create as many subdomains as they like in DNS, without registering anything extra. Each subdomain can point to a different server — a webshop, a mail server, a customer portal or a test site.
- Subdomain vs. subdirectory: blog.example.com is a subdomain (its own DNS name), example.com/blog is a folder on the same website.
- Multi-level subdomains: names like api.eu.example.com are subdomains of a subdomain. The finder lists them too.
- Wildcard subdomain: a record such as *.example.com makes every possible name resolve. That is why a plain DNS guess cannot tell which subdomains really exist, and why this tool filters wildcard matches out.
Other ways to get the subdomains of a domain
The finder above combines the two methods that work for any domain without special access. If you want to go further, these are the common alternatives:
Check one subdomain with nslookup or dig
To check whether a single subdomain exists, ask DNS directly. On Windows, macOS or Linux open a terminal and run nslookup shop.example.com; on macOS and Linux you can also use dig +short shop.example.com. An IP address or CNAME in the answer means the subdomain exists.
Look in your own DNS zone
For your own domain the full list of subdomains is simply your DNS zone: every A, AAAA and CNAME record in the DNS management of your domain is a subdomain. That is the only list that is guaranteed to be complete.
DNS zone transfer (AXFR)
In theory a zone transfer returns all records of a domain at once. In practice almost every name server refuses it for outside requests, so it rarely works — and that is how it should be.
Search engines and certificate searches
A site:example.com -www search shows subdomains that a search engine has indexed. Public certificate transparency search websites show the raw certificate entries this tool also uses, but without the DNS check and IP addresses.
Command-line enumeration tools
Security teams use open-source command-line tools that combine many sources and brute-force large word lists. Only run that kind of active enumeration against domains you own or have written permission to test.
Subdomeinen van een domein vinden
Met deze gratis subdomeinzoeker vindt u in een paar seconden de subdomeinen van een domeinnaam. De tool doorzoekt openbare certificate-transparency-logboeken en controleert veelgebruikte namen zoals www, mail en api in DNS. Handig om te zien welke websites en diensten er onder uw domein draaien, bijvoorbeeld vóór een verhuizing of een beveiligingscontrole.
Wilt u zelf een subdomein aanmaken of een DNS-record aanpassen? Lees dan DNS wijzigen: zo past u records aan. Een nieuwe domeinnaam nodig? Zie domeinnaam registreren. Wilt u ook de rest van uw website laten controleren, gebruik dan de gratis website scan.
Subdomains herausfinden
Mit diesem kostenlosen Subdomain-Finder finden Sie die Subdomains einer Domain in wenigen Sekunden. Geben Sie oben die Domain ein (zum Beispiel beispiel.de): Das Tool durchsucht öffentliche Certificate-Transparency-Logs, prüft gängige Namen wie www, mail und api im DNS und zeigt jede gefundene Subdomain mit ihrer öffentlichen IP-Adresse. Ohne Anmeldung, ohne Portscan.
Frequently asked questions
What is a subdomain finder?
A subdomain finder lists the subdomains that belong to a domain, such as www.example.com, mail.example.com or shop.example.com. It helps you see which host names exist for a domain, for example to inventory your own websites and services or to prepare a migration.
How does this tool find subdomains?
It combines two public sources. First it searches certificate transparency logs: every publicly trusted TLS certificate is logged, so host names that ever had a certificate show up there. Second it checks a fixed list of about 50 common names (www, mail, api, dev, staging and more) in public DNS. Found names are resolved to their public IPv4 addresses.
Is the subdomain finder free? Do I need an account?
Yes, it is free and you do not need an account. To keep the service fast for everyone there is a limit of 10 lookups per hour per connection.
Why do some subdomains have no IP address?
A name can appear in certificate logs but no longer exist in DNS, or it only points to an internal network. Internal and private IP addresses are never shown. For large domains only the first 150 names are resolved.
Does the tool scan ports or visit the websites it finds?
No. This version only reads certificate transparency logs and performs normal DNS lookups. It does not scan ports, does not connect to the hosts it finds and does not store your results.
Can this tool find every subdomain of a domain?
No method can guarantee a complete list. Subdomains that never had a public certificate and are not in the list of common names will not appear, and a wildcard DNS record can hide individual names.
Is it legal to look up subdomains?
Certificate transparency logs and DNS records are public by design, so looking them up is generally fine. Only use the results responsibly and do not test or attack systems you do not own or have permission to test.
How do I check if a subdomain exists?
Enter the main domain above and look for the name in the list, or check one name directly with a DNS lookup: run "nslookup shop.example.com" (Windows, macOS, Linux) or "dig +short shop.example.com" (macOS, Linux). If an IP address or CNAME comes back, the subdomain exists in DNS. No answer (NXDOMAIN) means the name does not exist — unless the domain uses a wildcard record.
How do I get all subdomains of my own domain?
For a domain you manage, the complete and reliable list is in your DNS zone: open the DNS management of the company where your domain is hosted and look at all A, AAAA and CNAME records. A subdomain finder like this one is useful to compare that list with what is publicly visible, for example to spot old certificates or forgotten test sites.
What is the difference between a subdomain checker, finder and scanner?
The words are used for the same thing: a tool that searches for subdomains of a domain and checks whether they exist. Some "scanners" go further and also scan ports or open each website. This tool deliberately does not: it only reads public certificate logs and DNS.
Can I find subdomains with a search engine?
Partly. A search such as "site:example.com -www" shows subdomains that a search engine has indexed. Many subdomains (mail servers, APIs, staging sites) are never indexed, so certificate transparency logs usually find more.
Need help with your domain, DNS or website?
IT Live is a Dutch provider of AI hosting, websites and IT services. Also try our free website scan (in Dutch).