Free Subdomain Finder
Discover subdomains using DNS enumeration of ~120 common names plus crt.sh certificate transparency logs. Best-effort, not exhaustive.
How it works
Enter a root domain
We probe common subdomains in parallel and search certificate transparency logs at crt.sh.
DNS-resolve the matches
Each candidate is resolved to its A/AAAA records. Records that don't exist are dropped.
Review the list
Subdomain → IP, sorted alphabetically. Source attribution (wordlist vs crt.sh) is in the summary.
Frequently asked questions
Why don't you list every subdomain?+
Wildcard DNS, internal-only subdomains, and DNS providers that don't allow brute enumeration all hide subdomains. Certificate transparency catches anything publicly served with a cert — but private hosts behind cloudflare with no public cert won't appear.
Is this legal?+
Yes. We only query public DNS and the public crt.sh dataset. No bruteforcing past what's published. Use the results responsibly — finding a subdomain isn't an invitation to attack it.
Why are some IP columns empty?+
We resolve at most 20 crt.sh-only candidates per request to keep latency reasonable. If you need IPs for everything, run the tool again on a specific subdomain via the DNS Record Lookup.
Is the wordlist customizable?+
Not yet — for now we ship a fixed ~120-word list focused on common SaaS and infrastructure subdomains.
Building a SaaS that needs custom domains?
Domainee is the API for adding customer custom domains to your product. One CNAME, automatic TLS, no DevOps to staff.
50 custom domains and 100 GB bandwidth free, forever.
More free tools
SSL
Free SSL Certificate Checker
View issuer, validity, expiration countdown, and certificate chain for any domain.
DNS
Free DNS Record Lookup
Check A, AAAA, CNAME, MX, TXT, NS, and SOA records for any domain instantly.
Domain
Free WHOIS Lookup
View registrar, creation and expiry dates, name servers, and registration data for any domain.
DNS
Free CNAME Lookup & Generator
Validate CNAME records and get provider-specific setup instructions for custom domains.
HTTP
Free HTTP Header Checker
Inspect response headers, security headers, caching, redirects, and get a security grade for any URL.
DNS
Free DNS Propagation Checker
Query DNS servers across multiple global locations to verify your DNS changes are live.