Free · No signup required
Subdomain Finder
Discover public subdomains for any domain — useful for security audits and attack surface mapping.
Try:
Attack surface mapping
Find forgotten subdomains before attackers do
Wildcard detection
Flags catch-all DNS so results stay accurate
Fast scan
Public subdomain discovery in seconds
Why subdomain discovery matters
Every subdomain is a separate publicly reachable entry point into whatever it hosts — and most organizations have more of them than they remember. This tool scans public DNS and certificate transparency records to surface every subdomain currently associated with a domain, which is the same reconnaissance technique used in both legitimate security audits and, less helpfully, by attackers mapping a target.
What the results mean
1
Subdomain list
Every publicly discoverable hostname under the domain — found via public DNS records and certificate transparency logs, the same sources security researchers use.
2
Wildcard warning
If a domain has wildcard DNS configured, it technically "resolves" for any subdomain name, which can make results look artificially complete. This tool flags that case so you know to interpret the count with caution.
3
Scan time
How long the discovery scan took — useful context for larger domains with many subdomains, where a thorough scan naturally takes longer than a small site with just a few.
Frequently asked questions
More Domain Tools
Everything you need to research and manage a domain, all free
Related guides
