Subdomain Finder

What the Subdomain Finder checks

Browsers only trust a TLS certificate that has been written to public Certificate Transparency (CT) logs. The logs let anyone spot a certificate issued by mistake or by an attacker, and as a side effect they list every hostname a domain has put on a certificate: shop, mail, staging, vpn and whatever else was set up over the years.

This tool asks crt.sh, a public CT search service, for the domain’s unexpired certificates and counts the distinct hostnames on them. It also notes a wildcard certificate (*.example.com), which covers names that never appear in the logs one by one. Only the domain name is sent to crt.sh; your website itself receives no request. Large domains can have thousands of names, so the count is marked as a lower bound when the answer is cut off.

Why it matters

Subdomains are where forgotten systems live: a test server from an old project, a campaign site nobody updates, an admin panel that was meant to be temporary. They run old software and nobody watches their logs, which makes them a common way in. A DNS record that still points at a cloud service you deleted can even let someone else take over the name and serve content on your domain.

Because the logs are public, a host that “nobody knows about” is already listed the moment it gets a certificate. That is also why this page shows only the number to visitors: the list of names is shown to the domain’s verified owner, so the tool can’t be used to map someone else’s systems. Verify your domain in your account with a DNS TXT record or a file, then run the tool again to see every hostname. See our guide to Certificate Transparency.

How to fix common problems

Go through the list and ask three questions for each host: is it still needed, who is responsible for it, and is it kept up to date? Shut down what you no longer use and delete its DNS records, especially CNAME records that point to third-party services you have cancelled.

Put internal tools behind a VPN, single sign-on or an access proxy instead of relying on an obscure name. For many short-lived internal hosts a wildcard certificate keeps their names out of the logs, although it does not make them any safer.

Finally, subscribe to a free CT monitoring service so you get an e-mail whenever a new certificate is issued for your domain. A certificate you did not ask for is an early sign of a misconfigured system or an attack. The full PerfoMetrix audit shows the subdomain count next to DNS, TLS and 170+ other checks.

Questions

Why do I only see a number?

The list of hostnames is shown only to the domain's verified owner, so the tool can't be used to map other people's systems. Verify the domain in your account (DNS TXT record or a file) and run the tool again.

Does the tool scan my website?

No. It reads public Certificate Transparency logs through crt.sh. Your website and DNS servers receive no request from this tool.

Why is a subdomain I use missing?

Only hostnames on unexpired, publicly trusted certificates are listed. A host covered by a wildcard certificate, served without HTTPS, or using a certificate from a private CA does not appear by name.

Is a high number of subdomains bad?

Not in itself. Large organisations have many. The number is a prompt to review what is there, not a score.