Skip to main content
Toolzum
Back to Developer

Subdomain Finder

Discover subdomains via public certificate records plus live DNS checks of common names. Read-only lookups run from your browser — the domain you check is visible to crt.sh and Google DNS, as with any lookup.

Cloud AI Browser Native

How to Use the Subdomain Finder

1. Enter the root domain

Bare domain — certificate records plus common-name DNS checks.

2. Review discovered names

Found subdomains with their sources, read-only from your browser.

3. Audit the attack surface

Investigate unknown names — forgotten staging hosts leak here.

Similar Tools You Might Need

See all

SSL/TLS Checker

Check a host over HTTPS from your browser — SSL/TLS reachability (which proves the browser validated the certificate chain) plus public issuance history (issuer, expiry, cert count) via crt.sh. No cipher-suite or protocol-version scan: browsers do not expose handshakes.

Open Tool

DNS Lookup Generator

Look up live A, AAAA, CNAME, MX, TXT, and NS records via DNS-over-HTTPS. Queries go to Google DNS — results display here.

Open Tool

SSL Checker

Check SSL/TLS certificate details for any domain via public certificate APIs. View issuer, validity period, days remaining, and SANs. Expiry alerts catch outages before users do — free, no signup.

Open Tool

IFSC Code Lookup

Looks up bank details from an 11-character IFSC code — bank name, branch, address, city, district, and contact info. Live lookup via the Razorpay IFSC API.

Open Tool

GSTIN Lookup

Checks any GSTIN format instantly — decodes state, embedded PAN, entity code, and check digit with Luhn mod-36 verification. Supports bulk file decode (up to 500) with CSV export for accounts teams.

Open Tool

Frequently Asked Questions

Where do the results come from?

Two sources: public certificate records (crt.sh) show names that ever had a certificate, and live DNS checks probe 24 common names (www, api, mail…). A name missing here can still exist — CNAME-only, unlisted, or firewalled names won't show.

Why do I see subdomains that no longer exist?

Certificate logs are historical: a name stays listed after the certificate expires or the host is retired. The 'Live' section shows only names that resolve right now.

Is this exhaustive like Amass or Sublist3r?

No — those run wordlists of thousands plus brute-forcing from a server. This tool covers certificate history plus two dozen common names, which catches the usual suspects honestly labeled as such.

Is scanning my own domain allowed?

Yes — it uses passive public certificate records plus read-only DNS checks. Nothing intrusive touches your servers.

Related Developer Tools

DNS Lookup Generator

Look up live A, AAAA, CNAME, MX, TXT, and NS records via DNS-over-HTTPS. Queries go to Google DNS — results display here.

WHOIS Lookup

Look up domain registration information using public RDAP APIs. Check registrar, expiration date, name servers, and more.

Last updated October 2026