Most companies know their main website. Fewer can list every subdomain that hangs off it. A staging server from a project that ended two years ago, a test login page, a marketing microsite built for one campaign: these hosts are easy to forget and easy for an attacker to find. If you want to find hidden subdomains before someone else does, you need a repeatable process and the right tools.A subdomain finder is a tool that discovers the subdomains tied to a root domain, such as staging.example.com or mail.example.com, by using public data sources like DNS records and certificate logs. You can run a free subdomain finder in your browser and get a first list in seconds, then use the techniques in this guide to go deeper.

This article covers how subdomain discovery works, how to find all subdomains of a domain step by step, which methods suit which situation and what to do with the results. It is written for MSSPs, MDR providers, penetration testers, bug bounty hunters and IT teams who need practical answers rather than theory.

What Is a Subdomain Finder?

A subdomain finder is a tool or technique that lists the subdomains belonging to a domain. A subdomain is a prefix added to a root domain to point to a separate service. In blog.example.com, the word blog is the subdomain and example.com is the root domain. Companies use subdomains for apps, APIs, customer portals, help centers, staging sites and internal tools.

The goal of a subdomain finder is to turn an unknown list into a known one. You enter a domain, the tool queries one or more data sources and it returns the hostnames it found. Some tools only read public records. Others also guess names from a wordlist and check whether those names resolve in DNS.

People use different names for the same activity. You will see subdomain enumeration, subdomain discovery, subdomain lookup, subdomain scanner and subdomain search. They all describe the same core job: building an inventory of hostnames under a domain.

It helps to be clear about what a subdomain finder does not do. It does not hack anything. It does not prove that a host is vulnerable. It gives you a list and the list is the starting point for the real work: checking ownership, patch status, exposure and whether the host should exist at all.

Subdomains Are Not Truly Hidden

The phrase hidden subdomains is a little misleading. Most subdomains are not secret. They are forgotten. If a host has a public DNS record or has ever received a publicly trusted TLS certificate, there is a good chance it left a trace somewhere. The skill is in knowing where to look and that is what the rest of this guide covers.

How a Subdomain Finder Works

A subdomain finder works by pulling hostnames from several kinds of sources and then removing duplicates. No single source is complete, so good tools combine them. Here are the main techniques.

Certificate Transparency Logs

When a certificate authority issues a publicly trusted TLS certificate, it records that certificate in public Certificate Transparency logs. The system is described in RFC 6962 from the IETF. Each certificate lists the hostnames it covers, which means those logs are a rich record of subdomains that have had HTTPS enabled.

Searching these logs is one of the most reliable passive methods. It reveals hosts that no one has linked to from the main site. Public search interfaces such as crt.sh let you query the logs by domain name. The limitation is that a host without a certificate, or one that sits behind a wildcard certificate, may not appear by its own name.

Public and Passive DNS Records

DNS records map hostnames to addresses and other data. Public DNS data, along with passive DNS databases that store historical lookups collected by security vendors, can reveal subdomains that existed in the past or still exist today. Services such as VirusTotal and DNSdumpster aggregate this kind of data and let you search by domain.

Passive DNS is useful for catching old hosts that have since been removed from live DNS but may still have dangling references elsewhere.

Search Engines and Google Dorks

Search engines index pages on many subdomains. A query such as site:example.com -www returns results from hosts other than the main www site. It is crude, but it costs nothing and often surfaces marketing pages, documentation portals and forgotten admin panels.

Wordlist Brute-Forcing

Brute-forcing means taking a list of common names, such as dev, test, staging, api, vpn and mail, adding each one to the root domain and checking whether the result resolves in DNS. This is an active technique because it sends many queries to DNS servers. It finds subdomains that appear in no public log, as long as the name is guessable. Naming patterns matter here: teams tend to reuse the same words, so a good wordlist finds a lot.

Zone Transfers

A DNS zone transfer, defined in RFC 5936, copies a full zone from one DNS server to another. If a name server is misconfigured and allows transfers to anyone, a single request can return every record in the zone. This is rare today because most servers restrict it, but it is worth testing on authorized engagements because a success is a serious finding.

Wildcard DNS and False Positives

Wildcard DNS, described in RFC 4592, lets a zone answer for any name that does not have its own record. If a domain uses a wildcard, every guessed name will appear to resolve and a brute-force run will return thousands of false hits. A careful subdomain finder tests for wildcards first by querying a random, nonsense hostname. If that name resolves, the tool must filter results accordingly.

How to Find Subdomains of a Domain Step by Step

The best way to find all subdomains of a domain is to start passive, then add active checks, then validate. Work through the steps in order and only run active techniques against infrastructure you own or have written permission to test.

Step 1: Start With a Free Online Subdomain Finder

Begin with a quick online lookup. Enter the root domain into a browser-based subdomain finder and review what comes back. Mispar's free tool checks public DNS records, certificate logs and known naming patterns, needs no signup and does not touch the target server directly. It also says plainly that no tool finds every subdomain, so treat the first result as a baseline rather than a final answer.

Step 2: Query Certificate Transparency Logs

Next, search the logs directly so you can see the raw data. On crt.sh, a search for %.example.com returns certificates issued for any subdomain. You can also request JSON output and parse it on the command line:

This returns a sorted, unique list of names found in certificates. Remove wildcard entries and anything that does not end in your domain, then keep the rest as candidates.

Step 3: Use a Command-Line Enumeration Tool

Open-source tools combine many sources in one run. Subfinder from ProjectDiscovery is a passive tool that queries multiple public sources. A basic run looks like this:

subfinder -d example.com

OWASP Amass is a longer-standing project that supports both passive collection and active techniques:

amass enum -d example.com

Both tools are common on Kali Linux and in bug bounty workflows. Sublist3r is an older Python tool that you will still see in tutorials and many people now prefer Subfinder or Amass for broader source coverage. Running two tools and merging the output usually finds more than running one.

Step 4: Check Passive DNS and Third-Party Datasets

Search the domain in VirusTotal and DNSdumpster and in Shodan if you have access. These sources often include hosts discovered through scans or historical lookups that never appeared in a certificate. Add anything new to your candidate list.

Step 5: Run Wordlist Brute-Forcing (Authorized Targets Only)

If you are allowed to send active traffic, brute-force common names. First test for a wildcard:

If that returns an answer, the domain uses wildcard DNS and you must filter results by response content or address. If it returns nothing, run a DNS brute-forcing tool with a wordlist, for example:

Choose a wordlist that fits the target. A general list is fine to start, but a list built from naming patterns your client uses will find more.

Step 6: Try a Zone Transfer

On authorized work, find the domain's name servers and request a transfer.Most servers will refuse. If one answers, record it as a finding and report it.

Step 7: Resolve, Validate and De-Duplicate

Merge every list, remove duplicates and resolve each name to see which ones are live. For live hosts, note the IP address, the response and the technology behind it. A host that resolves to a cloud service that no longer exists deserves immediate attention, which leads to the takeover risk covered later.

Step 8: Compare Against What You Expect

Give the final list to the people who own the infrastructure and ask one question for each unfamiliar entry: who owns this and do we still need it? Unknown or ownerless hosts are your highest priority.

How to Find Subdomains Without Tools

You can find subdomains without installing anything. Use a search engine with the site: operator and exclude the main host. Open a certificate search page in your browser and look up the domain. Check the website's own sitemap, robots.txt and page source for links to other hosts. Look at a company's job postings, documentation and public code repositories, which often mention internal-sounding hostnames by accident.

These methods are slower and less complete than automated ones, but they are a good way to understand what a subdomain finder is doing behind the scenes and they require no special access.

How Do Hackers Find Subdomains?

Attackers use the same sources described above. They start with certificate logs, passive DNS, search engines and open-source enumeration tools because these methods are quiet and cheap. MITRE ATT&CK, a public knowledge base of adversary behavior, lists searching open technical databases, including DNS data and digital certificates, as a reconnaissance technique.

The practical lesson is simple. If an attacker can build your subdomain list in minutes from public sources, you should be able to do the same thing first. Defenders have an advantage here only if they run the process regularly.

Why Security Teams and MSSPs Need a Subdomain Finder

Every subdomain is a possible entry point and you cannot protect a host you do not know exists. Running a scan to find hidden subdomains gives security teams a current view of their external attack surface, which is the set of internet-facing assets an attacker could probe.

Mispar's tool page describes the problem well: many breaches do not begin at the main website but at a subdomain nobody remembers, such as a staging server left open, an old test login page, or a marketing microsite with weak security. That matches what practitioners see in the field, where neglected hosts tend to be less patched and less monitored than production systems.

Value for MSSPs and MDR Providers

For managed providers, subdomain discovery is part of onboarding a new client. Before you can monitor an environment, you need to know what is in it. A fresh enumeration often finds shadow IT, which means services that a department set up without involving the security team. It also gives you something concrete to show a prospect: here are the hosts we found that you did not list.

Value for Penetration Testers and Bug Bounty Hunters

For testers, enumeration is the foundation of reconnaissance. A wider asset list means more places to test and forgotten hosts are often where findings come from. Good notes from this phase save time later, because you can return to the same list as scope changes.

Value for SEO and Competitive Research

Marketing and SEO teams also use subdomain discovery. An SEO audit may need to find old subdomains that still get indexed, duplicate content, or retired campaign pages. Some teams also review the public subdomains of competitor websites to understand how a company structures its products and regional sites. Only public data should be used for this.

Subdomain Takeover Risks

A subdomain takeover happens when a subdomain's DNS record points to a service that no longer exists or is no longer claimed and an attacker registers that resource and gains control of the subdomain's content. A common setup is a CNAME record that points to a third-party hosting or cloud service after the team has canceled the account but left the DNS record in place.

The damage can be real. An attacker who controls a trusted subdomain can host phishing pages, serve malicious files, or in some setups interfere with cookies tied to the parent domain. The OWASP Web Security Testing Guide includes a dedicated test for subdomain takeover, which shows how widely the risk is recognized.

You can reduce the risk with a few habits:

• Remove DNS records when you decommission a service, not after.

• Review CNAME records regularly for targets that no longer resolve or return provider error pages.

• Keep an owner and a purpose on record for every subdomain.

• Re-run discovery after major launches and migrations.

A subdomain takeover finder is really just a subdomain finder plus a check on where each record points. The enumeration step comes first.

Key Features to Look For in a Subdomain Finder

Not every tool fits every job. When you compare options, look at these features.

• Multiple data sources. A tool that reads only one source will miss hosts. Certificate logs, public DNS and passive datasets each cover gaps in the others.

• Passive and active modes. Passive discovery is safe for any domain you are researching. Active modes add coverage but need authorization.

• Wildcard handling. The tool should detect wildcard DNS and filter out false positives.

• Clear output. You want a clean, de-duplicated list you can export or paste into another tool.

• Low friction. For quick checks, a browser-based tool with no signup saves time.

• Honest limits. A good tool tells you what it cannot find. Mispar's tool page states that no tool finds every subdomain, which is the right way to describe any enumeration method.

• Safe operation. Prefer tools that rely on public information when you are checking domains you do not manage and always get permission before scanning infrastructure that is not yours.

Passive vs. Active, Manual vs. Automated and Free vs. Paid

Three comparisons come up in almost every discussion of subdomain discovery.

Passive vs. active: passive enumeration collects information from existing public sources without sending traffic to the target's servers. Active enumeration sends queries or probes, such as brute-forcing names or attempting a zone transfer. Passive is quieter and safe for general research. Active finds more but needs permission and can trigger alerts.

Manual vs. automated: manual methods such as search operators and browser lookups teach you how the data works and need no setup. Automated tools run many sources at once, repeat the process on a schedule and scale across many domains. Most professionals use both: automation for coverage, manual checks for odd cases.

Free vs. paid: free tools and open-source projects cover the core sources well and are enough for many jobs. Paid platforms usually add scheduling, history, alerting and team workflows. I will not quote prices here because they change, so check a vendor directly if you are comparing options. For a one-off check, a free online tool is often all you need.

Comparison Table: Subdomain Finding Methods Side by Side

The table below compares the main methods covered in this guide.

Common Mistakes When You Try to Find Hidden Subdomains

A few errors show up again and again.

• Relying on one source. Any single method has blind spots, so combine at least certificate logs, passive DNS and one enumeration tool.

• Ignoring wildcard DNS. Without a wildcard test, a brute-force run can produce a long list of names that do not really exist.

• Treating the list as complete. Even the best process misses hosts. Use the result as an inventory to improve, not proof that nothing else exists.

• Scanning without permission. Passive lookups on public data are one thing, while active probing of another organization's systems is another. Get written authorization before any active work.

• Running it once. New subdomains appear whenever a team launches a campaign page or a test environment. A common habit is to check monthly and after any major launch.

• Not following up. A list that nobody reviews has no security value. Assign an owner to every host and decommission anything that is no longer needed.

Interesting Facts and Key Stats

These facts come from standards bodies and public documentation, so you can verify each one.

• Certificate Transparency is defined in RFC 6962, published by the IETF in 2013. It describes public, append-only logs of issued TLS certificates, which is why certificate search is such a useful source for subdomain discovery.

• Google Chrome began requiring Certificate Transparency for newly issued publicly trusted certificates in April 2018, according to Google's published Chrome policy. This pushed most certificate authorities to log their certificates and made the logs a much richer data source.

• Wildcard DNS behavior is described in RFC 4592 and it is the reason enumeration tools must test for wildcards before trusting brute-force results.

• DNS zone transfers are defined in RFC 5936. Properly configured servers limit them to trusted peers, so a successful transfer from the public internet is treated as a misconfiguration.

• The OWASP Web Security Testing Guide includes a specific test case for subdomain takeover, which reflects how established this risk is in web application security practice.

• MITRE ATT&CK lists searching open technical databases, including DNS data and digital certificates, as a reconnaissance technique used by real adversaries. The same public data that helps defenders also helps attackers.

I have deliberately not included breach statistics or percentages here. Figures on this topic vary by report and year and quoting a number without a source you can check would weaken the article.

Conclusion

Finding hidden subdomains is less about clever tricks and more about consistent habits. Start with public sources, add active checks where you have permission, validate what you find and put an owner next to every host. A subdomain finder gives you the first list quickly and the methods in this guide help you widen it.No single tool finds everything, so treat every result as a starting point. Re-run the process after launches and migrations, decommission what you no longer need and watch for dangling records that could lead to a takeover. If you want a fast first pass on any domain, the free online tool from Mispar is a simple place to begin.

Frequently Asked Questions (FAQs)

How do I find all subdomains of a domain?

Start with a free online subdomain finder, then search certificate transparency logs such as crt.sh, check passive DNS sources like VirusTotal and DNSdumpster and run an enumeration tool such as Subfinder or Amass. On authorized targets, add wordlist brute-forcing. Merge the lists, remove duplicates and resolve each name. No method finds every subdomain, so combine several.

Is a free subdomain finder accurate?

A free subdomain finder is accurate for the sources it reads, but it is not complete. Tools that rely on public DNS records, certificate logs and common naming patterns will list many real hosts but can miss subdomains that appear in none of those places. Use the result as a starting point and confirm it with a second source.

What is the difference between passive and active subdomain enumeration?

Passive enumeration collects subdomains from existing public data, such as certificate logs and DNS datasets, without sending traffic to the target's servers. Active enumeration sends queries to the target's DNS infrastructure, for example by brute-forcing names or attempting a zone transfer. Passive is quieter. Active finds more but requires authorization.

How do I find hidden subdomains of a website without tools?

Use a search engine with the site: operator and exclude the main host, search a domain on a certificate transparency site in your browser and check the site's sitemap, robots.txt and page source for links to other hosts. These manual methods are slower than automated tools but need no installation.

Is it legal to run a subdomain finder on a domain I do not own?

Passive lookups use public information and are widely used for research. Active techniques such as brute-forcing or zone transfer attempts send traffic to someone else's infrastructure, so you should only run them with written permission. When in doubt, ask the domain owner or stay with passive sources and check the rules that apply to your situation.

How often should I check for new subdomains?

Check regularly, because new subdomains appear whenever a team launches a campaign page or a test environment. A common cadence is monthly and after any major launch or migration. Larger organizations with fast-moving teams often automate the process so it runs on a schedule.