Passive Subdomain Finder
Enter a domain to list the hostnames below it that appeared in publicly logged certificates, with their current DNS state from public resolvers.
- Security intelligence
- Live check
- Free, no sign-up
- Results are not published
Run Passive Subdomain Finder
At a glance
- What it checks
- List hostnames publicly observed in Certificate Transparency logs and whether they still resolve — no brute force, no scanning.
- Data source
- Names in public Certificate Transparency logs, checked against public DNS resolvers.
- Freshness
- Live check; results are cached for up to 6 hours
- Limits
- Only publicly observed hostnames: wildcard, private and non-HTTPS names never appear. No brute force or scanning. Methodology
- Cost
- Free, no account needed
Understanding the result
How the finder works
Every publicly trusted TLS certificate is recorded in Certificate Transparency logs together with the names it covers. The finder collects the names below your domain from those certificates, removes duplicates and invalid entries, and lists them with the date they were last seen in a certificate.
It is passive: it never guesses names, never uses wordlists and never connects to the hosts. The only active step is an ordinary DNS lookup of the most recently observed names through public DNS-over-HTTPS resolvers.
What the DNS states mean
- Resolves: the name currently has an IPv4 or IPv6 address.
- Matches wildcard: the domain answers for invented names too, and this name returned exactly the wildcard answer, so it may not be configured on its own.
- No address: the name exists in DNS but has no address record (it may be used for mail or other services).
- No longer resolves: DNS says the name does not exist (NXDOMAIN).
- Unknown: the resolver did not answer; nothing is assumed.
- Observed in CT: not checked in DNS because only the most recent names are checked per search.
Why this is not a list of all subdomains
Only names that were placed in a public certificate can appear. Hostnames served with wildcard certificates, internal names, and names that never used HTTPS are invisible to Certificate Transparency. Listed names can also be long gone. The result therefore speaks of publicly observed hostnames, never of all subdomains.
Using the results
Owners use the list to find forgotten services, old staging hosts and DNS entries that should have been removed. A name that still resolves but that you no longer use is worth cleaning up. For certificate details — issuers and validity dates — use the Certificate Transparency Search, and check a live site with the SSL Checker.
Frequently asked questions
Does DomainDNSCheck scan my servers?
No. Names come from public certificate logs, and the only lookups are standard DNS queries to public resolvers. No ports, paths or services are probed.
Why is a subdomain I know about missing?
It may use a wildcard certificate, a private certificate or no certificate at all, or it may be beyond the result limit for very large domains.
How many hostnames are shown?
Up to 300 names, most recently observed first. The 40 most recent are checked in DNS on each search to keep the tool fast and fair to the resolvers.
Can I hide hostnames from Certificate Transparency?
Names already logged stay public. For future certificates, a wildcard certificate avoids publishing individual hostnames.