Why Subdomain Discovery Matters
Organizations create subdomains for everything: shop, mail, vpn, test, old. Over time some are forgotten but stay online, often running outdated software. Finding them is a standard step in security assessments, asset inventories and migrations. Our Subdomain Discovery tool is a quick starting point.
Use these methods on domains you own or are authorized to test. Passive methods only read public data, but active scanning of someone else’s systems can violate laws or terms of service.
Method 1: Certificate Transparency Logs
Publicly trusted TLS certificates are recorded in Certificate Transparency (CT) logs. Every certificate lists the hostnames it covers, so searching the logs for a domain reveals many subdomains — including ones that were never linked anywhere. Public search interfaces such as crt.sh make this easy. Wildcard certificates (*.example.com) hide individual names, so coverage is incomplete.
Method 2: Passive DNS Data
Passive DNS databases store DNS answers observed over time. They can show subdomains that existed in the past and the addresses they pointed to. Our tool uses names seen in DNS lookups performed on this site, and our IP History tool shows earlier addresses of a domain.
Method 3: Search Engines
A query such as site:example.com -www lists indexed pages on subdomains other than www. This only finds public, indexed sites, but it is free and fast.
Method 4: Wordlist Guessing
Tools can try common names (dev, staging, api, admin and thousands more) and see which ones resolve. This is effective but generates many DNS queries, so use it only with permission. Wildcard DNS records, which answer every name, cause false positives and must be detected first.
Method 5: Zone Transfer (AXFR)
A DNS zone transfer copies the entire zone, including every subdomain. Properly configured nameservers only allow transfers to their own secondary servers, so a public AXFR request is normally refused. If one succeeds against your own domain, that is a misconfiguration worth fixing.
Comparing the Methods
| Method | Type | Strength | Limitation |
|---|---|---|---|
| CT logs | Passive | Finds unlinked HTTPS hosts | Wildcards hide names |
| Passive DNS | Passive | Shows history | Only observed names |
| Search engines | Passive | Free and simple | Only indexed sites |
| Wordlists | Active | Finds unpublished names | Noisy; needs permission |
| Zone transfer | Active | Complete list | Almost always refused |
What to Do With the Results
- Check that each subdomain still resolves with DNS Record Lookup.
- Look for dangling records: a CNAME pointing to a deleted cloud resource can be taken over by someone else. Remove records you no longer use.
- Check which services respond with HTTP Headers and Port Scanner (on your own systems).