Subdomain Finder
Enter a domain to list subdomains seen in public certificate records, check which still resolve, and spot forgotten records that could be taken over.
Questo contenuto è in inglese.
Esempi svolti
Finding names for a domain
example.com typed into the box
(Illustrative) 18 names found in public certificate records, with the 12 most recently seen checked in DNS and their addresses listed.
Hosts that never had a certificate will not appear, so the list is not complete.
Name pointing to a retired service
blog.example.com found with a record pointing to a service name that no longer exists
(Illustrative) Flagged as a possible takeover risk, with the record shown.
Fix or remove the record so the name cannot be claimed by someone else.
Informazioni su Subdomain Finder
Most organisations have more subdomains than they remember: old test sites, staging servers, campaign pages, support portals and services that were set up once and forgotten. Each one is part of your public footprint, and a forgotten record can be a way in for someone else. This tool lists subdomains that appear in public certificate records, then checks in DNS which of them still resolve and where they point. Reviewing this list from time to time is a simple habit that helps you keep your domain tidy and your records under control.
Enter a domain and we collect the names from the certificate records, remove duplicates and wildcard prefixes, and make sure each name really sits under your domain. Up to 500 names are listed and the 100 most recently seen are looked up. Records that point to a hosting service whose name no longer exists are flagged as a possible takeover risk, because someone could claim that name and serve content from your subdomain. You can download the whole list as a CSV. Everything is gathered from public records and ordinary DNS answers, so nothing about your own servers is touched or changed by the check.
Come usare Subdomain Finder
- Enter the domain you want to look at, such as example.com.
- Select Find subdomains. Large domains can take up to half a minute.
- Check the counts for names found, live and not resolving.
- Open the list of subdomains to look at first for any takeover warnings.
- Download the CSV to keep or share the full list.
Usi comuni
- Auditing a company's public footprint before a security review
- Finding forgotten test and staging sites that are still online
- Cleaning up DNS after cancelling a hosting or marketing service
- Checking a domain you have just inherited or bought
- Looking for records that could be taken over
Domande frequenti
Where do the subdomain names come from?
They come from public certificate records. Whenever a site gets an HTTPS certificate the names on it are logged publicly, so the records show subdomains that have had certificates. Hosts that never had one, or that are only used internally, will not appear, so treat the list as a strong starting point rather than a complete inventory.
What is a possible takeover risk?
It is a record that points to a service, such as a hosting or page-building platform, where the target name no longer exists. If that platform lets anyone register the name, an attacker could claim it and publish content on your subdomain. Remove the record or recreate the service to close the gap.
Why are some names not checked?
To keep results quick we look up the 100 most recently seen names in DNS and list up to 500 in total. Names beyond that are shown without a status. If a domain has more names than that, try a more specific subdomain as the starting point to see the rest.
What does wildcard DNS mean here?
Some domains answer for any name you make up. When that happens every subdomain looks live, which is misleading. We test with a made-up name and, if it resolves, we tell you and mark names that only match the wildcard so you can treat them with caution.
Why does a certificate name appear that does not exist now?
Certificates are logged when they are issued and stay in the record for years. A name can be there long after the site was removed. That is useful, because an old name with a record still pointing at a deleted service is exactly the kind of thing worth cleaning up.
Can I search a subdomain instead of the main domain?
Yes. Enter something like dev.example.com and the tool lists names beneath it. Entering only an ending such as com or co.uk is refused, because the result would be enormous. Very large domains can occasionally time out, in which case you can try again shortly or narrow the search.