Popular tools

Theme

Subdomain Finder

Find subdomains of any domain from certificate logs, a list of common names, its homepage and DNS records, then see which ones resolve, where each runs and when its certificate expires.

Sources: Cert Spotter and crt.sh (CT log searches) · common names, homepage, DNS records, zone transfer · live DNS from Google · networks from Team Cymru

6 sources · live DNS

A subdomain or URL works too: docs.python.org searches all of python.org.

  • Cert Spotter · Unexpired only · our server
  • crt.sh · Since 2013 · your browser
  • Common names · 1,000 labels · our server
  • Homepage · Links, headers · our server
  • DNS records · NS, MX, SPF… · our server
  • Zone transfer · Each nameserver · our server
DNS checkGoogle Public DNSA, AAAA and CNAME for each name
Try

How does a subdomain finder work?

It collects names from public records and the domain's own DNS, then asks DNS about each one.

Every HTTPS certificate a trusted authority issues is written to Certificate Transparency logs with each name it covers. This finder reads two log search services: Cert Spotter for current certificates and crt.sh for every certificate since 2013. In parallel it asks DNS about 1,000 common names, reads the homepage's links and the domain's own records, and tries a zone transfer.

Then DNS turns the list into a map. A name that resolves gets its addresses and the network that announces them, which names the host or CDN. A name from a certificate or a DNS record that doesn't resolve today was real once: a retired name. A homepage link may point to a name that never existed.

  • Cert Spotter511.1 s
  • crt.sh7421.6 s
  • Common names242.6 s
  • Homepage141.9 s
  • DNS records10.4 s
  • Zone transferRefused ×42.3 s
Merged
Duplicates and wildcards removed, the domain itself not counted
81subdomains
DNS: A, AAAA, CNAME
61 resolve20 don't
Hosts and CDNs
10networks
  • Certificate logs: every name on a public certificate; Cert Spotter is current, crt.sh goes back to 2013.
  • Common names, homepage, records: live names no certificate lists.
  • DNS: one question per name and type to Google Public DNS.
python.org, searched on October 22, 2026: what each step found and how long it took.
Subdomain finder result for python.org: 81 subdomains, which resolve, the host map and each name's certificate datesSubdomain finder result for python.org: 81 subdomains, which resolve, the host map and each name's certificate datesThe answer firstHow many names were found, how many resolve today, and on how many networks.DNS facts, not verdictsWildcard DNS, wildcard certificates, names that don't resolve, names no certificate log lists and the zone transfer, each with its evidence.Where each name runsOne band per host or CDN, as wide as its number of names, with the platforms its CNAMEs reveal.Every name, one click awayEach label is a link to its row: status, addresses, CNAME chain, host and certificate dates.
A search for python.org: the totals, the DNS notes and the map of where each subdomain runs. Select a number to see what each part shows.

How do I find all subdomains of a domain?

Combine passive records with a few DNS questions: no single method finds every name.

Certificate logs list every name that ever had a public certificate, but nothing under a wildcard and nothing that never served HTTPS. Asking DNS for common names finds live hosts the logs never saw. The homepage and the domain's records name a few more, and a zone transfer, where a server allows it, lists the whole zone.

This finder runs all of them at once. Methods that need a paid dataset (passive DNS) or that copy other sites' data against their terms (search-engine scraping, some public APIs) aren't used.

MethodFindsMissesHere
Certificate logsEvery name on a public certificate since 2013Names under wildcards; names that never had HTTPSBoth searches
Common namesLive hosts with guessable labelsUnusual labels1,000 + 4,000
HomepageHosts the site links or loadsUnlinked namesYes
DNS recordsMail, nameserver and SPF hostsEverything elseYes
Zone transferThe whole zone, where allowedRefused almost everywhereEach nameserver
NSEC walkingEvery name in a plain-NSEC zoneNSEC3 and unsigned zonesNot yet
Passive DNSNames seen in resolver trafficNeeds a paid datasetNo
Search enginesHosts of indexed pagesUnindexed names; scraping breaks their termsNo
Subdomain search methods: what each finds, what it misses, and which this finder runs.

How do I find subdomains that have no certificate?

Ask DNS for likely names: every domain we measured had live names that no certificate log has ever listed.

We asked 1,000 common labels (www, mail, vpn, dev…) under 13 well-known domains and compared the hits with crt.sh's full history. Each domain had 3 to 71 live names no log ever showed; uber.com (71), kompas.com (37) and github.com (32) gained the most. The homepage's links added up to 65 more (kompas.com); wordpress.org's 160 linked language sites can't be confirmed in DNS, because its wildcard answers every name.

The finder asks the first 1,000 labels of the SecLists list by default and 4,000 more on request, which found about 60% more hits for five times the questions in all. Wildcard DNS is tested first, so a guessed name counts only when it has its own record.

Live names no certificate log ever listed1,000 common labels, wildcard answers removed
  • uber.com71
  • kompas.com37
  • github.com32
  • stripe.com28
  • tesla.com22
  • tokopedia.com20
  • wordpress.org14
  • nasa.gov13
  • isc.org7
  • ycombinator.com6
  • python.org5
  • mozilla.org5
  • dnsrobot.net3
  • never in CT
  • in CT logs
  • wordpress.org: wildcard DNS: resolving proves nothing
DNS Robot measurement, October 22, 2026: 13 domains, compared with crt.sh's full history.

What is Certificate Transparency, and how does it reveal subdomains?

Certificate Transparency (CT) is a set of public, append-only logs of every certificate trusted authorities issue.

Browsers enforce it: Chrome rejects a certificate issued after April 30, 2018 unless it carries signed timestamps from CT logs. Each log is a Merkle tree that anyone can read and no one can change, so once a certificate is logged, every name in it is public, often before the site starts using it.

That is why a new subdomain shows up here as soon as it gets HTTPS, and an old one stays findable after it's switched off. A certificate transparency search such as crt.sh or Cert Spotter reads those logs for you; this finder asks both.

Google Argon 2026h2one of the logs Chrome trusts3.45B entries
oldest entryappend only: entries are never changed or removednewest
The logged certificate
Issuer
Let's Encrypt
Issued
Oct 20, 2026
Expires
Jan 18, 2027
Names in the certificateblurb-it.python.org
In this finder
blurb-it.python.orgResolves
↳ …elb.amazonaws.comAWS
Who issued the certificates logged in the 28 days to October 22, 2026
  • Let's Encrypt 52.35%
  • Google Trust Services 22.21%
  • Every other authority 25.44%
Sources: Argon 2026h2's signed tree head and Cloudflare Radar's CT data, October 22, 2026; the certificate from Cert Spotter.

Why doesn't a subdomain resolve?

Because DNS no longer has an address for it: the name was deleted, never had an address, or points at something that's gone.

NXDOMAIN means the name doesn't exist any more. No address (NOERROR with no A or AAAA record) means it exists but only for other records, such as mail. Dangling means its CNAME points at a target that doesn't exist.

Old names are the norm: of 2,036 names in the certificate logs of 11 domains we checked, half no longer existed. A name that doesn't resolve isn't an error on this page; it's a retired name you may want to clean up.

2,036 names from the certificate logs of 11 domains
  • 922 resolve (45%)
  • 1,008 NXDOMAIN (50%)
  • 106 no address (5%)
  • blog-stage.python.org
    $ dig blog-stage.python.org
status: NXDOMAIN
    Doesn't resolveThe name doesn't exist.
  • mg.python.org
    $ dig mg.python.org A
status: NOERROR, ANSWER: 0
$ dig +short mg.python.org MX
10 mxa.mailgun.org.
    No addressIt exists, but only for other records, such as mail.
  • shop.example.com
    $ dig shop.example.com
shop.example.com. CNAME old-shop.example.net.
old-shop.example.net: NXDOMAIN
    DanglingIt points at a name that's gone.
DNS Robot measurement, October 22, 2026. The examples are made-up names under example.com, except blog-stage and mg, from python.org's search.

What is a dangling CNAME?

A dangling CNAME is a DNS record that still points at a name that no longer exists, such as a deleted load balancer or a canceled hosted service.

It's first a cleanup item: the subdomain shows an error, and the record does nothing. In 2,036 certificate names from 11 domains we found 25 dangling CNAMEs, on 8 of the 11 domains, mostly deleted cloud load balancers.

It can also be a risk. If the target is a service where anyone can claim the freed name, such as a storage bucket or a site on some platforms, a stranger could serve pages on your subdomain: a subdomain takeover. This finder shows the DNS fact for every name, and says “possible takeover” only when the CNAME and the page both match a service's published unclaimed-resource signature.

The recordshop.example.comCNAME
The targetold-shop.example.netNXDOMAIN: deleted
25

25 dangling CNAMEs in 2,036 names (1.2%), on 8 of 11 domains

  • Deleted cloud load balancers
  • Retired Skype for Business Online endpoints
  • A canceled hosted forum
  1. DanglingThe CNAME target doesn't existA DNS fact, shown for every name: delete the record if it's unused.
  2. Possible takeoverThe CNAME and the page match a service's unclaimed-resource signatureShown with the evidence. Signals, not proof.
  3. Not takeover-proneThe service verifies who owns a domainFastly, CloudFront, Zendesk, Statuspage and others: never flagged.
DNS Robot measurement, October 22, 2026; the levels follow can-i-take-over-xyz. The record shown is made up.

Is your DNS zone transfer open?

Almost certainly not: all nameservers of the 12 real domains we tested refused a DNS zone transfer.

A zone transfer (AXFR) exists to copy a zone to its secondary servers. Asked by anyone else, an open server sends every name in the zone. RFC 5936 says servers should restrict it and shouldn't be open to all by default.

The finder sends one AXFR question to each of the domain's nameservers and reports each answer. Only the test domain zonetransfer.me, set up to show the problem, answered with its 52 records.

AXFR question to each nameserverAXFR python.org
  • ns-1134.awsdns-13.org205.251.196.110REFUSED
  • ns-2046.awsdns-63.co.uk205.251.199.254REFUSED
  • ns-981.awsdns-58.net205.251.195.213REFUSED
  • ns-484.awsdns-60.com205.251.193.228REFUSED
zonetransfer.me · the public test domain
  • nsztm1.digi.ninjaAXFR zonetransfer.me52 records sent

12 of 12 real domains refused on every nameserver

DNS Robot measurement, October 22, 2026: python.org's four nameservers, and zonetransfer.me.

Why can't every subdomain be found?

Because some names are never public: no certificate names them, no link points at them, and no common label matches.

Three kinds of names rarely or never reach the logs, and DNS only finds them if their label is guessable. About 36% of certificate entries logged in the 28 days to October 22, 2026 carried a wildcard name, and each one hides the names it serves.

  • *.python.org?.python.org?.python.orga.b.python.orgcoveredcoveredtwo labels deep:not coveredserved, but never listed in a log

    Names under a wildcard

    A *.python.org certificate covers every name one label deep without listing any of them. The log records the wildcard, not the names it serves.

    In the logsOnly *.python.org
  • Office network, private DNSintranet.corp.exampleprinter.corp.examplenas.corp.example
    Public CT logs
    no public certificate

    Names on a private network

    Names that exist only in a company's internal DNS rarely get a public certificate. Without one, they never reach a log.

    In the logsNothing
  • ssh.example.com:22relay.example.com:25ftp.example.com:21
    no HTTPS, no certificate

    Names that serve no HTTPS

    An SSH host, a mail relay or an old FTP server needs no public certificate, so its name often never reaches a log.

    In the logsNothing
36%of certificate entries logged in the 28 days to October 22, 2026 carried a wildcard name (Cloudflare Radar). Each one hides the names it serves.

Where is each subdomain hosted?

Each name's addresses belong to a network, and the network names the host or CDN that runs it.

The finder asks Team Cymru which network announces each address, then matches the network and the CNAME chain against the Hosting Checker's 200+ providers. A CNAME often names the platform behind a CDN: Read the Docs behind Cloudflare, or Heroku and Netlify on Amazon's network.

Behind a CDN, the addresses are the CDN's edge, the same for many sites; the server behind it stays private. The finder never guesses an origin address.

Where python.org's subdomains run61 resolve
  • DigitalOceanAS1406114
  • FastlyAS5411311
  • GitHub PagesAS5411311
  • Amazon Web ServicesAS16509· via9
  • HetznerAS249406
  • CloudflareAS13335· via5
  • Google CloudAS396982· via2
  • OVHcloudAS162761
  • Advanced Software Production Line, S.L.AS2061021
  • Civilized Discourse Construction Kit, Inc.AS394230· via1
  • University of OregonAS37011
  • CDN edge: shared addresses, the origin stays private
  • the host's own network
python.org, October 22, 2026: names that resolve, by host, from Team Cymru's networks and the CNAME chains.

What is subdomain enumeration?

Subdomain enumeration is listing a domain's subdomains, passively from public records or actively with DNS questions and requests.

Passive sources read what is already public, such as certificate logs, and send nothing to the domain's servers. Active checks ask DNS one question per name, here through Google Public DNS, fetch the homepage, or ask the domain's own nameservers for a zone transfer. Security teams enumerate to find forgotten hosts before someone else does, often with a subdomain scanner; a subdomain scan here runs only the light, standard checks: common names, records, the homepage and a zone transfer.

Passive

Reads public records; sends nothing to the domain

  • Cert Spotter51 names
  • crt.sh74 names

Active

Asks Google Public DNS about each name, fetches the homepage and asks each nameserver for the zone

  • Common names24 names
  • The homepage14 names
  • DNS records1 name
  • Zone transferRefused ×4
python.org's search: what each kind of source found.

How do NSEC and NSEC3 hide or reveal a zone's names?

In a zone signed with DNSSEC, NSEC records chain every name to the next, so anyone can walk the chain; NSEC3 hashes the names to stop that.

Asking for a missing name in a plain NSEC zone returns the two real names around it; repeating that walks the whole zone. NSEC3 returns hashes instead, which a dictionary can still crack. A newer method, compact denial (RFC 9824), reveals no neighbor at all.

Most domains we checked use NSEC3 or no DNSSEC; a few, such as isc.org, still use plain NSEC.

NSECthe next real name, in order

?blog.example.comapi.example.com→docs.example.com
isc.orgnlnetlabs.nlsidn.nlripe.net

NSEC3the next name's hash

?blog.example.com2vptu5timamqttgl…→b4um86eghhds6nea…
iana.orgicann.orgverisign.comnic.czdenic.deafnic.frpaypal.combund.degov.uk

Compact deniala made-up next name: nothing to walk

?blog.example.comblog.example.com→\000.blog.example.com
cloudflare.com

No DNSSECNXDOMAIN

?blog.example.com→NXDOMAIN
google.comdnsrobot.net
Denial-of-existence answers for a random name, DNS Robot measurement, October 22, 2026. The chain shown is made up.

What can you do with the list?

Keep an inventory, clean up old records and check what each subdomain serves.

Export the list as CSV, delete the records of names that no longer resolve, and check the certificate, host and DNS records of the ones that do.

Data and credits

  • Certificate data from Cert Spotter (SSLMate) and crt.sh (Sectigo).
  • Common names: the first 1,000 (and 5,000) labels of subdomains-top1million-5000.txt from SecLists, © Daniel Miessler, MIT License.
  • Takeover signatures adapted from can-i-take-over-xyz by EdOverflow and contributors, CC BY 4.0, modified by DNS Robot.
  • Networks from Team Cymru's IP to ASN service; DNS answers from Google Public DNS.

Subdomain Finder FAQ

What is a subdomain finder?

A subdomain finder, also called a subdomain lookup or subdomain search tool, lists the names under a domain, such as blog.example.com. This one runs two Certificate Transparency log searches, asks DNS about 1,000 common names, reads the homepage and the domain's DNS records, and tries a zone transfer. Then it checks every name in live DNS: whether it resolves, its addresses and its host.

Is this subdomain finder free, and what are the limits?

Yes, free and with no sign-up. Each search lists every name the sources return and checks up to 2,000 of them in DNS; the rest are listed as not checked, with a button for the next 500. You can check 4,000 more common names, and up to 100 web servers a click. Answers are kept per domain for a few hours, never per visitor.

How many subdomains can a domain have?

There is no fixed limit. DNS caps each label at 63 characters and a full name at 253 as written (255 octets on the wire), but no standard limits how many names a zone holds. Most domains have a few dozen; large organizations have thousands. In our tests nasa.gov had over 21,000 names in the certificate logs, and python.org 81 subdomains across all sources.

Why are some subdomains missing?

A name appears only if some source knows it. Names under a wildcard certificate, names on private networks and names that never served HTTPS rarely or never reach the certificate logs, and DNS only finds them when their label is a common one. About 36% of certificate entries logged in the 28 days to October 22, 2026 carried a wildcard name. A zone transfer would list everything, but nearly every server refuses it.

What is crt.sh?

crt.sh is a free certificate transparency search run by Sectigo. It reads every log Chrome trusts and keeps each certificate since 2013, so it also lists names whose certificates have expired. It can be slow and can lag weeks behind the busiest logs, so this finder asks it from your browser and adds Cert Spotter for current certificates.

Is it legal to look up a domain's subdomains?

Reading certificate logs is reading public records: logging every name is the point of Certificate Transparency. The DNS questions this finder asks are the same ones any browser or mail server asks, one per name. Deeper testing of systems you don't own, such as port scans or login attempts, needs the owner's permission; this tool does none of that.

How do I check if a subdomain is live?

Search its domain here and look at its row: Resolves means DNS gives it an address today, with the addresses and the host beside it. Doesn't resolve means NXDOMAIN or no address. To see whether a web server answers, select Check web servers: the status code, page title and server appear under each name. This makes the finder a subdomain checker too.

What is a wildcard certificate?

A wildcard certificate covers every name one label deep, such as *.example.com for blog.example.com and shop.example.com, without listing them. Certificate logs then show only the wildcard, so the names it serves stay hidden from any finder that reads the logs. A wildcard never covers two labels: a.b.example.com needs its own name on a certificate, or a *.b.example.com wildcard.

What is a DNS zone transfer?

A DNS zone transfer (AXFR) copies a whole zone, every name and record, from one nameserver to another. It exists so secondary servers stay in sync. If a server allows it to anyone, the zone can be downloaded, so servers should restrict it to their secondaries. This finder tests each nameserver and shows open, refused or not testable.

What is a subdomain takeover?

A subdomain takeover happens when a DNS record, usually a CNAME, still points at a cloud or hosted resource that was deleted, and someone else claims that resource's name. They can then serve content on the subdomain. This finder shows dangling CNAMEs as a DNS fact, and says possible takeover only when the CNAME and the page match a known unclaimed-resource signature.

Can I hide my subdomains?

Partly. Use a wildcard certificate so names don't appear in the logs one by one, keep internal names in internal DNS, refuse zone transfers to anyone but your secondaries, and avoid guessable labels for private services. Names in DNS are rarely secret, though: treat every public name as findable and protect the service behind it.

Is there an API?

Yes. GET https://dnsrobot.net/api/subdomain-finder?domain=example.com streams each stage as a line of JSON to scripts and servers; pages on other websites can't call it from a browser (they get 403). The POST with {"domain": …} keeps answering in the previous version's format. The API is free, with a limit of 10 searches a minute per address, and the crt.sh step is left to the caller.

Missing something?Suggest a feature or a new tool

More domain and DNS tools