Subdomain Finder (Certificate Transparency)

Find the subdomains of a domain from public Certificate Transparency logs: every name that appeared on a publicly trusted SSL certificate, with the date of the latest one.

How it works

Why subdomains show up in CT logs

Every public certificate is logged

Browsers require publicly trusted certificates to be recorded in Certificate Transparency logs, so every name on them becomes public.

Audit your attack surface

Forgotten staging sites and old services often still have DNS and certificates. Review the list and remove what you no longer use.

Wildcards hide names

A *.example.com certificate covers every subdomain without listing them, so names served under a wildcard do not appear individually.

FAQ

Frequently asked questions

Why is a subdomain I use missing?

It is served under a wildcard certificate, uses a private certificate, or has never had its own certificate.

Can I hide subdomains from CT logs?

Use a wildcard certificate for internal names. Names on individual public certificates cannot be removed from the logs.

More free tools

All tools

DNS LookupQuery A, AAAA, MX, TXT, NS, CAA and more from public resolvers.WHOIS LookupRegistrar, dates, status and nameservers of any domain.DNS Propagation CheckerSee what resolvers around the world return for your domain.DNSSEC CheckerValidate a domain's DNSSEC chain: DS, DNSKEY and signatures.Punycode ConverterConvert international domain names to and from xn-- form.SSL CheckerCheck a site's certificate, chain, expiry and TLS versions.HTTP Headers CheckerSee status codes, redirects and response headers of a URL.What Is My IPYour public IP address, reverse DNS and browser details.

Free certificates for every subdomain

DV, OV and EV from trusted CAs

SSL Certificates