Introduction

Subdomain Finder is a free online tool that helps you discover publicly accessible subdomains associated with any domain name. By searching trusted public sources such as Certificate Transparency (CT) logs and DNS records, the tool quickly identifies known subdomains without performing intrusive scans or requiring authentication.

Subdomains often reveal different services running under the same domain, including web applications, APIs, development environments, staging servers, mail services, dashboards, and customer portals. Understanding a domain's public infrastructure can help website owners organize their assets, assist developers during troubleshooting, and support security professionals during reconnaissance and security assessments.

Simply enter a domain name, and the tool returns a list of discovered subdomains together with their resolved IP addresses. Results can be exported as a CSV file for documentation, reporting, or further analysis.

Why Use This Tool

Finding subdomains manually can be time-consuming and incomplete. Public Certificate Transparency logs contain valuable information about domains that have been issued SSL/TLS certificates, making them one of the most reliable sources for discovering publicly exposed subdomains.

This tool automatically searches multiple public data sources and presents the results in a clean, easy-to-read format. Instead of performing manual lookups, you can quickly build an inventory of publicly known subdomains and their associated IP addresses.

Whether you're auditing your own infrastructure or researching a public domain, Subdomain Finder provides a fast and convenient starting point.

Common Use Cases

• Discover publicly available subdomains for any website
• Audit your organization's exposed internet assets
• Identify development and staging environments
• Find API, mail, or dashboard subdomains
• Perform passive reconnaissance during security assessments
• Build an inventory of public web services
• Verify Certificate Transparency records
• Support penetration testing workflows
• Investigate domains during incident response
• Export discovered subdomains for documentation

How the Tool Works

1. Enter a Domain

Type the domain name you want to analyze.

2. Search Public Sources

The tool queries Certificate Transparency logs and other public DNS-related data sources.

3. Resolve IP Addresses

Each discovered subdomain is matched with its current IP address whenever available.

4. Review the Results

Browse the discovered subdomains directly in your browser.

5. Export as CSV

Download the results for reporting, documentation, or additional analysis.

Features

• Discover publicly available subdomains
• Uses Certificate Transparency data
• Resolves IP addresses automatically
• Fast online lookup
• Browser-based tool
• No software installation required
• CSV export support
• Easy-to-read results
• Works with most public domains
• Free to use

Tips for Best Results

• Enter the root domain only, such as example.com.
• Verify discovered subdomains before assuming they are active.
• Combine the results with DNS lookups for additional validation.
• Use exported CSV files when documenting security assessments.
• Remember that not every existing subdomain appears in public records.
• Re-run searches periodically as new certificates are issued.
• Use the results as a starting point rather than a complete inventory.

Supported Input

• Domain names
• Public websites
• Company domains
• Organization domains

Examples:

• example.com
• cloudflare.com
• github.com
• microsoft.com

Output

The tool returns:

• Discovered subdomains
• Resolved IP address for each subdomain
• Total number of discovered subdomains
• CSV export file

Privacy and Security

This tool performs passive lookups using publicly available information. It does not attempt to scan, probe, or access the target domain directly. Your searches are processed only to retrieve publicly accessible records and are not used to perform intrusive network activity.

Learn More About Subdomain Discovery

Want to understand what the discovered subdomains and IP addresses actually mean?

Read our complete guide to learn how subdomain discovery works, how Certificate Transparency logs help reveal publicly known hostnames, why multiple subdomains can point to the same IP address, and why some discovered subdomains may no longer be active.

The guide also explains how to interpret Subdomain Finder results correctly and the limitations of passive subdomain discovery.

Learn how to find subdomains and understand the results

Frequently Asked Questions (FAQ)

What is a subdomain?

A subdomain is a subdivision of a primary domain that points to a separate website, service, or application. For example, blog.example.com and api.example.com are subdomains of example.com.

How does Subdomain Finder work?

The tool searches publicly available Certificate Transparency logs and DNS-related sources to identify subdomains associated with a domain.

Are all subdomains guaranteed to appear?

No. Only subdomains that are publicly discoverable through available data sources can be found. Private or internal subdomains typically won't appear.

Does this tool actively scan websites?

No. It performs passive lookups only and does not send intrusive requests to the target servers.

Why are Certificate Transparency logs useful?

Certificate Transparency logs record publicly issued SSL/TLS certificates, making them an excellent source for discovering subdomains that use HTTPS.

Why do some subdomains have no IP address?

Some records may no longer resolve, may require additional DNS configuration, or may have been removed after the certificate was issued.

Can I export the results?

Yes. You can download the discovered subdomains as a CSV file for documentation or further analysis.

Is this tool free?

Yes. You can search for publicly available subdomains and export the results without installing any software.

Is this tool useful for website owners?

Yes. Website owners can use it to review publicly exposed assets, identify forgotten subdomains, and better understand their internet-facing infrastructure.

Can I use this tool for security research?

Yes. The tool is useful for passive reconnaissance, asset discovery, and security auditing of publicly available domains.