Subdomain Finder
Discover active subdomains of any domain. Checks 100+ common subdomain names via DNS-over-HTTPS and reports which ones resolve. Use only on domains you own or have permission to test.
Subdomain Finder — FAQ
How many subdomains does this tool check?
This tool checks over 100 of the most commonly used subdomain prefixes including www, mail, ftp, api, dev, staging, blog, shop, admin, vpn, and many more. For comprehensive enumeration, combine with certificate transparency log searches at crt.sh.
Why might some subdomains not be found?
This tool uses a wordlist approach — it only finds subdomains that match its list. Custom or obscure subdomains won't be found. For complete discovery, use certificate transparency logs which record all TLS certificates issued for a domain's subdomains.
What should I do if I find unexpected subdomains?
Unexpected subdomains can indicate forgotten infrastructure, shadow IT, or potential security risks. Subdomains pointing to services you no longer use can be vulnerable to subdomain takeover attacks — where attackers register the abandoned service and take over the DNS entry.