Subdomain Finder
Discover a domain's subdomains from public Certificate Transparency logs and check which ones are still live.
Frequently Asked Questions
How does the subdomain finder work?
Every publicly trusted TLS certificate is recorded in public Certificate Transparency (CT) logs. The tool searches those logs for certificates issued to names under your domain, then de-duplicates the results.
Does it scan or contact the target domain?
No. Discovery is fully passive: it only reads public certificate logs. The optional live check sends ordinary DNS queries from your browser to a public DNS-over-HTTPS resolver, which is the same as looking the names up yourself. Nothing is sent to the target's servers.
Why are some subdomains missing?
Only hosts that have had a publicly trusted certificate appear in CT logs. Internal hosts, hosts covered only by a wildcard certificate, and hosts served over plain HTTP will not show up by name.
What does "wildcard" mean in the results?
The name only appeared as a wildcard certificate, such as *.dev.example.com. The parent name exists, but the individual hosts under it are not listed in the logs. If the domain uses wildcard DNS, the live check marks every name as resolving, so the tool tests a random name first and warns you when that happens.
Why do some results not resolve?
CT logs keep history. A certificate issued years ago may name a host that has since been removed. Use the live check and the last-seen date to separate current hosts from old ones.
Is this tool free?
Yes, ToolDock's subdomain finder is free and requires no signup. Results are cached for a few hours to keep the public certificate log services responsive.
Related Tools
Fuzzy Domain Finder
Generate and analyze variants of a domain name to find potential phishing or typosquatting threats.
Open Ports Lookup
See which ports and services an IP address or hostname exposes to the internet, with known CVEs — without scanning it.
DNS Lookup
Query DNS records for any domain using Google or Cloudflare.