What the subdomain finder is for
Every SSL certificate a public certificate authority issues is recorded in Certificate Transparency logs, along with the names it covers. The subdomain finder searches those logs for a domain and lists every subdomain that has appeared on a certificate still in use, such as www, mail, shop or api. Use it to take stock of your own domain, find forgotten test sites that are still online, or check what a domain runs before an audit. Each name opens a DNS lookup. Subdomains that never had a certificate don't appear.
Frequently asked questions
Is it legal to look up a domain's subdomains?
Yes. Certificate Transparency logs are public by design and searching them only reads published information. Testing those systems for weaknesses is a different matter and needs the owner's permission.
Why are some subdomains missing?
Only names that appeared on a certificate still in use are listed. Internal names, names covered only by a wildcard certificate and names that never had a certificate don't show up.
How can I hide a subdomain?
Use a wildcard certificate for it, so the exact name never appears in the logs. Keeping a name private is not real protection though; secure the service itself.