Subdomain Finder - Certificate Transparency & DNS

Enumerate the subdomains of any domain from public Certificate Transparency logs, then resolve each one to see which are actually live. No brute forcing, no wordlists: every publicly trusted TLS certificate is logged, so the names are a matter of record.

No API key, no proxy needed.

What you get per subdomain

Field	Example
subdomain	api.example.com
domain	example.com
ipAddresses	["93.184.216.34"]
cname	example.map.cdn.net
isLive	whether it resolves today
certificateCount	how many certificates mention it
firstSeen, lastSeen	earliest and latest certificate dates
certificateExpired	whether the newest certificate has lapsed
issuers	Let's Encrypt, DigiCert, ...
isWildcard	whether the entry is a wildcard name

Input

• domain - the domain to enumerate, e.g. example.com
• resolveDns - resolve each name to A records or a CNAME (on by default)
• onlyLive - keep only names that resolve
• includeWildcards - include *.example.com style entries
• includeExpired - include names whose certificates have expired (on by default, since they reveal historical infrastructure)
• maxResults - how many subdomains to save

Example input

{
  "domain": "example.com",
  "resolveDns": true,
  "onlyLive": true,
  "maxResults": 1000
}

Use cases

• Attack surface management - inventory what a domain actually exposes, including hosts nobody remembers
• Authorised penetration testing and bug bounty recon - build the target list before scanning
• Shadow IT discovery - find staging, admin and vendor-hosted hosts under a corporate domain
• Certificate hygiene audits - spot expired certificates and unexpected issuers
• Technology and vendor mapping - CNAME targets reveal which SaaS platforms a company uses, which is strong B2B signal
• M&A technical due diligence - see the infrastructure footprint of a target company from the outside

Why Certificate Transparency beats brute forcing

Since 2018, browsers only trust certificates that have been logged publicly. Every HTTPS host a company has ever issued a certificate for is therefore recorded, including internal-sounding names that never appear in DNS zone transfers or wordlists. Historical entries also survive after a host is decommissioned, which is why firstSeen and lastSeen are worth keeping.

DNS resolution then separates today's live infrastructure from the historical record.

Notes

• Large domains can have thousands of certificates. The crt.sh query is thorough rather than fast and can take some tens of seconds before results start flowing.
• isLive is null when resolveDns is off.
• A name with isLive false but a recent lastSeen is often a host behind an internal-only DNS zone, which is exactly what makes it interesting in an audit.
• Use this only on domains you own or are authorised to assess. Enumeration is passive, but what you do with the result may not be.