Web Tools

Subdomain Finder

Find common subdomains for any domain using DNS lookups. Check www, mail, ftp, api, blog, and 30+ common subdomains.

Server-assisted public lookup

Checking subdomains via DNS lookups…

Found Subdomains
Subdomain IP Address Status

No common subdomains found for this domain.

Results are fetched from our server, not your browser.

Next useful step

Related tools

5 selected

01 Dmarc Checker Continue with a nearby task 02 Dns Checker Continue with a nearby task 03 Mx Checker Continue with a nearby task 04 Spf Checker Continue with a nearby task 05 Whois Lookup Continue with a nearby task

What is the Subdomain Finder?

Subdomain discovery is an important step in security assessments, asset inventories, and competitive research. Subdomains like api.example.com, staging.example.com, or mail.example.com often expose additional services or older, less-secured applications. This tool discovers subdomains for a target domain using DNS brute-forcing, certificate transparency log queries, and public data sources.

How to use the Subdomain Finder

  1. Enter the root domain you want to investigate (e.g., example.com).
  2. Click Find Subdomains to begin the discovery process.
  3. Results will populate as they are found, showing each subdomain and its resolved IP address.
  4. Click any result to see DNS record details (A, AAAA, CNAME, MX) for that subdomain.
  5. Export the full list as CSV or JSON for use in security tools or documentation.

Frequently asked questions

Querying public DNS records and certificate transparency logs for subdomains is legal passive reconnaissance. Actively brute-forcing DNS on domains you do not own or have written permission to test may violate computer fraud laws and terms of service. Always obtain proper authorization before conducting security assessments.
Certificate transparency is a public audit log where all SSL/TLS certificates issued by trusted CAs must be logged. Because certificates include the domain and Subject Alternative Names (SANs), searching CT logs reveals many subdomains that have had SSL certificates issued.
Subdomains that have never had a public SSL certificate, are not in DNS brute-force wordlists, and are not referenced anywhere publicly will not be discoverable by passive methods. Internal subdomains and those using private DNS will also not appear.