A subdomain finder lists the names that sit under a domain, such as www, blog, shop or staging. This tool searches the public certificate transparency logs at crt.sh, where publicly trusted SSL certificates are recorded, and returns each subdomain those certificates name, sorted and without duplicates. It is free and needs no signup.
How to use the subdomain finder
- 1Type the domain, such as example.com. Leave off the page path.
- 2Press Check, or hit Enter. The search runs on crt.sh and gives up after 15 seconds if crt.sh is slow.
- 3Read the count first, such as "3 subdomains found.", then the list. Big domains show the first 500.
- 4Click any name to open https:// on it in a new tab and see whether it still answers.
When to use it
- You are taking over a client's website and want to see what else runs on their domain, such as a shop or a help centre.
- You suspect an old staging or test site is still public and indexed by Google.
- You are mapping a competitor's setup: a separate blog, shop, help centre or app on its own subdomain.
- You are tidying DNS and want a list of names to check before you delete records.
Worked example
A small site's subdomains
We searched our own domain.
- URL to check
- searchblueprint.io
- Result
- 3 subdomains found. links.searchblueprint.io, searchblueprint.io, www.searchblueprint.io
Three names, and one of them is the bare domain, which the logs list because certificates are issued for it too. The www name is the usual alias, and links is the only other name in the logs. Nothing unexpected, which is the answer you hope for. On an older domain this list is often longer, and a forgotten dev or staging name here is worth opening.
What the list does and does not show
- It shows names found in certificates, so a subdomain that never had its own certificate may be missing.
- It includes old names. A certificate stays in the log after the subdomain is deleted, so open a name before you assume it is live.
- It does not guess names or query DNS, and it does not show IP addresses.
- A certificate for *.example.com is shown as example.com, because a wildcard does not name a real subdomain.
Made by SearchBlueprint
This finder is free with no signup. SearchBlueprint, who make it, sell SEO planning: a plan that shows the searches a site could be found for, subdomains included.
Get your free plan