Subdomain Finder - CT-log enumeration + live DNS check

Subdomain Finder lists every subdomain of a domain found in public Certificate Transparency logs, with an optional live DNS check of each, at $0.005 per domain (all its subdomains in one record) on the Apify Free plan.

You give it	You get back	You pay (Free plan)
One domain or a list of up to 100 (25 by default)	Per domain: ok, domain, subdomainCount, subdomains (each with name, resolves, ips), checkedAt	$0.005 per domain (not per subdomain)

Pay per result only: no subscription, no start fee. Failed lookups are not charged. Paid Apify plans get Store discounts on the price above.

Example: try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "domain": "github.com",
  "domains": [
    "apify.com"
  ]
}

Real output from that exact input (run on 2026-09-24; long arrays shortened to a few entries and long text cut for display):

[
  {
    "ok": true,
    "domain": "apify.com",
    "subdomainCount": 36,
    "subdomains": [
      {
        "name": "affiliate.apify.com",
        "resolves": true,
        "ips": [
          "216.150.16.1",
          "216.150.1.1"
        ]
      },
      {
        "name": "api.integrations-securitybyobscurity.apify.com",
        "resolves": false,
        "ips": []
      }
    ]
  }
]

Discover a domain's subdomains from public Certificate Transparency logs (crt.sh), then optionally DNS-resolve each one to see which are live and collect their IPs. One clean record per domain listing every subdomain found. Built for attack-surface mapping, asset inventory, and recon.

$0.005 per domain - all its subdomains in one record, not per subdomain. A domain with 115 subdomains still costs half a cent. Failures are recorded free.

What you get

• CT-log enumeration via crt.sh for %.<domain> - catches subdomains that never appear in DNS brute-force lists.
• Optional live DNS check (resolve): A/AAAA lookup + CNAME fallback, marks resolves and collects ips.
• De-duplicated, scoped strictly to the target domain, sorted.
• Fail-soft: a domain with no CT records returns subdomainCount: 0 gracefully (a successful lookup, so it is charged); a lookup error returns {ok:false, error} and is not charged.

Input

{ "domain": "github.com", "domains": ["example.com"], "resolve": true, "maxDomains": 25 }

Output (real run, 2026-08-07 - 115 subdomains for github.com)

{
  "ok": true,
  "domain": "github.com",
  "subdomainCount": 115,
  "subdomains": [
    { "name": "api.mcp.github.com", "resolves": null, "ips": [] },
    { "name": "api.security.github.com", "resolves": null, "ips": [] },
    { "name": "camo.github.com", "resolves": null, "ips": [] }
  ],
  "checkedAt": "2026-08-07T21:12:00.000Z"
}

With resolve: true, each subdomain also carries resolves: true/false and an ips array.

Pricing - $0.005 per domain, all subdomains included

$0.005 per domain on the Apify Free plan, however many subdomains it has, billed as the domain-checked event. Paid Apify plans pay less ($0.00465 Bronze, $0.00435 Silver, $0.004 Gold, $0.00365 Platinum, $0.00335 Diamond). No start fee. Failed lookups are recorded free. A full 100-domain run costs $0.50 on the Free plan.

Limits (honest ones)

• Source is Certificate Transparency (crt.sh) - subdomains that never had a public certificate won't appear (no DNS brute-forcing).
• crt.sh is a third-party service; a rare timeout returns a graceful {ok:false, error} record, uncharged.
• With resolve: true, large domains take longer (DNS per subdomain, bounded concurrency).
• maxDomains capped at 100 per run.

FAQ

• Where do the subdomains come from? Public Certificate Transparency logs via crt.sh - real certificates issued for the domain.
• Does it brute-force names? No - CT logs only. That avoids noise and rate-limiting, and finds names a wordlist would miss.
• What does resolve do? Runs a live DNS lookup on each subdomain so you can tell which are actually up.
• Why one record per domain? So you pay once per target, however many subdomains it has.
• How many domains per run? Up to 100 (maxDomains, default 25). Pass one domain, a domains list, or both.

When not to use this

• You need internal or never-certificated hosts. CT logs only contain names that appeared on a public certificate. A staging box on plain HTTP, or one behind a wildcard cert, will not show up. A DNS brute-forcer with a wordlist is the tool for that, and it costs far more per target.
• You need real-time discovery. CT logs lag issuance by minutes to hours, and crt.sh indexes on its own schedule. A subdomain created five minutes ago may not be there yet.
• You want port scans, tech fingerprints or screenshots of each host. This returns names and (with resolve: true) IPs. Feed those into a scanner or into our HTTP Headers Inspector for the next step.
• You only care about one known hostname's DNS records. Use a DNS records lookup instead - this actor's job is discovering names you did not know about.
• You are not authorized to enumerate the target. CT logs are public, but what you do with an attack-surface map is your responsibility.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~subdomain-finder/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"domain":"github.com","resolve":true}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com).

Related actors

• DNS Records Lookup (EliAI/dns-records-lookup) - returns every DNS record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV) for a single domain. This actor discovers subdomain names from Certificate Transparency logs; that one dumps the DNS records of a name you already have.

Who uses it

• Bug bounty hunters enumerating a program's subdomains from Certificate Transparency logs
• Security teams inventorying forgotten subdomains that still resolve
• Pentesters mapping attack surface and IPs for a client domain before testing
• IT asset managers finding subdomains teams created outside central DNS tracking
• Researchers comparing how many subdomains a set of companies expose

Changelog

• 2026-11-01: Page text only: the "Try it" block is now headed Example. Code, output and price are unchanged.
• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.