# Subdomain Finder

List the subdomains of a domain seen in public Certificate Transparency logs. Passive: only public certificate records are read; no names are guessed, no ports scanned and the target is not contacted. For each name returns when it was first and last seen, how many certificates named it and whether it is a wildcard; with resolve it also looks up the current addresses (up to 200 names), the network behind them and whether a CNAME points at a service that may no longer be claimed (a hint, never proof). Email addresses and other non-host names are left out and counted. At most 2,000 names, 100 per page.

**Not for:** Finding names that never had a certificate (plain HTTP, internal names, wildcard-only setups).

- Tool id: `subdomain-find`
- Category: dns
- Execution: fanout
- MCP tool `subdomain_find` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/subdomain-find` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `domain` | string | yes |  | A domain you own or are allowed to look at, such as example.com. Not a public suffix like com. Only public certificate records are read. min length 1, max length 253 |
| `resolve` | boolean | no | `false` | Also look up where each name points now (A, AAAA and CNAME), for up to 200 names. Slower. |
| `includeExpired` | boolean | no | `true` | Include names that only appear in expired certificates. |
| `groupBy` | "name" \| "network" \| "year" | no | `"name"` | How the list is ordered and grouped: by name (newest first seen), by the network the name points to (needs resolve), or by the year it was first seen. |
| `page` | integer | no | `1` | Page of 100 names, 1 to 20 (the cap is 2,000 names). min 1, max 20 |
| `all` | boolean | no | `false` | Return every name (up to 2,000) in one answer instead of a page of 100. For exports. |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `domain` | string |  |
| `display` | string | The domain in Unicode when it is an internationalised name. |
| `resolve` | boolean |  |
| `includeExpired` | boolean |  |
| `groupBy` | "name" \| "network" \| "year" |  |
| `all` | boolean | True when every name was asked for (an export): `names` holds the whole list and the text form is a CSV. |
| `source` | object |  |
| `counts` | object |  |
| `names` | object[] |  |
| `strip` | object[] | New names per year (per month when the span is under two years), for the first-seen strip. |
| `groups` | object |  |
| `page` | object |  |

## Examples

### Subdomains of example.org

```json
{"domain":"example.org","resolve":false,"includeExpired":true,"groupBy":"name","page":1,"all":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/subdomain-find?all=false&domain=example.org&groupBy=name&includeExpired=true&page=1&resolve=false'
```

Web page: https://lookupowl.com/subdomain-finder?q=example.org

### Where github.com's names point now

```json
{"domain":"github.com","resolve":true,"includeExpired":false,"groupBy":"network","page":1,"all":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/subdomain-find?all=false&domain=github.com&groupBy=network&includeExpired=false&page=1&resolve=true'
```

Web page: https://lookupowl.com/subdomain-finder?q=github.com&groupBy=network&includeExpired=false&resolve=true

## Web pages

- https://lookupowl.com/subdomain-finder

## Limits and caching

- Cost: from 1 unit up, depending on the input (a registry lookup counts every upstream request); 1 unit for a cached result. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are kept for 3600 s.
- Timeout: 60 s.

## Related tools

- [Certificate Transparency Search](https://lookupowl.com/tools/ct-search.md): Every certificate logged in Certificate Transparency for a domain: who issued it, when, and for which names. A fast crt.sh alternative.
- [DNS Lookup](https://lookupowl.com/tools/dns-lookup.md): Look up A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, DS and DNSKEY records from a public resolver or the authoritative nameserver.
- [Who Hosts This Website](https://lookupowl.com/tools/website-hosting.md): Find the web host or CDN, DNS provider and email provider behind a domain, with the evidence, and whether the origin is hidden.
- [Reverse DNS Lookup](https://lookupowl.com/tools/reverse-dns.md): Find the host name (PTR record) of an IPv4 or IPv6 address and check that it resolves back to the same address.
- [SSL Certificate Checker](https://lookupowl.com/tools/ssl-checker.md): Check a site's SSL/TLS certificate: days until it expires, whether it is trusted, matches the host and has a complete chain.

## Guide: Subdomain finder

List the names under a domain that appear in public certificates, with when each was first seen and where it points now.

### What passive means

Passive means we only read public certificate records. We do not guess names, try a wordlist, scan ports or contact the domain you enter. Every name on the page was written into a certificate that a trusted authority issued and logged in public.

That is also its limit. A subdomain that never had a certificate will not appear: a site that only uses plain HTTP, a name used inside a company, or a name covered by a wildcard certificate. A wildcard such as `*.example.com` hides the individual names under it, so we can show that it exists but not what it covers.

The list is therefore the names that appear in certificates. It is a good map of the public side of a domain, and it is not everything that exists.

### How to use it

1. **Enter a domain you own or may look at**: Type a domain such as `example.com`. A public suffix such as `co.uk` is refused, because it is not one domain.
2. **Choose whether to check where names point**: Switch on "Check where each name points now" to look up the address of up to 200 names, and the network behind each one. It is slower, so it is off by default.
3. **Scan the list**: The subdomain part is in bold and the domain is quiet, so hundreds of names are easy to read. Each row shows when the name was first and last seen and how many certificates named it.
4. **Look at the strip**: The strip above the list shows how many new names appeared in each year, or each month for a young domain. It shows when the estate grew.
5. **Export it**: Copy the names on the page, or download all of them as CSV or JSON. The export always holds the whole list, not just the page you are on.

```bash
# The same list from a terminal, with where each name points
curl "https://lookupowl.com/api/v1/tools/subdomain-find?domain=example.org&resolve=true"
```

### Names that may be forgotten

When names are checked, one pattern is worth a look: a name that is a CNAME to a hosted service, where the service name it points at no longer exists. That is the shape of a forgotten record, and for some hosted services it can mean someone else is able to register the missing name and serve content on yours.

We mark such names "possibly forgotten" and say what they point at. It is a hint from the way the name looks, not a confirmed problem, and we never try to take anything over or fetch the name to find out. If one of your own names is flagged, the fix is to remove the DNS record or to reclaim the service it points at.

> **Calm by design** The audience for this tile is the owner of the domain. The wording says "may be" because we cannot know, and the page never calls a name vulnerable.

### Where the names come from

The names come from Certificate Transparency, the public logs where certificate authorities record what they issue. We read them through crt.sh and Cert Spotter and share the data with the [certificate search](https://lookupowl.com/certificate-transparency-search), which shows the certificates behind these names. Each name keeps the dates of the first and the last certificate that named it, which is why an old name can show up long after the site is gone.

- **Email addresses and other non-hosts** that appear in certificates are left out, and the page says how many.
- **Wildcards** are listed as wildcards and are not looked up, because they do not name a host.
- **At most 2,000 names** are listed, the most recently seen first, and at most 200 are looked up in DNS.
- **Searches for one domain are paced**, because the logs have small quotas.

### What people use it for

- **Owners tidying up.** Find the test, staging and old project names that still have a record, and the ones that point at a service you cancelled.
- **Security reviews.** Map the public side of a company's domain before an assessment, from information that is already public.
- **Migrations.** List the names that must move before a change of host or DNS provider. For the hosting of the main site, use the [website hosting lookup](https://lookupowl.com/who-hosts-this-website).
- **Learning.** See how a real domain is laid out and how it grew over the years.

To look closer at one name from the list, open it in the [DNS lookup](https://lookupowl.com/dns-lookup).

### Frequently asked questions

**Is the list complete?**

No. It is the names that appear in public certificates. A name with no certificate, an internal name and anything hidden behind a wildcard will not show up. Treat it as a good start, not a full inventory.

**Do you scan the domain or guess names?**

No. We only read public certificate records. We never guess names, use a wordlist, scan ports or contact the domain you enter, and there is no option to turn any of that on.

**Why is a name here that does not exist any more?**

Certificates keep a name on record after the site is gone, and the logs never forget. The first and last seen dates show how old a name is, and "No address now" marks names that no longer answer in DNS.

**What does "possibly forgotten" mean?**

The name is a CNAME to a hosted service, and the name it points at no longer exists. Someone else may be able to claim it. It is a hint, not proof, and we do not try to claim or fetch anything.

**Why were some names left out?**

Certificates sometimes name email addresses or other things that are not hosts. We leave those out and tell you how many. Names on the same certificate that belong to other domains are not shown either.

**Why only 200 names looked up?**

Each lookup is a question to the DNS, and we keep the work fair for everyone. The 200 most recent names are checked and the rest are listed without addresses. The export still holds every name.

**Can I run this from a script or an AI assistant?**

Yes. The same list is available as JSON from the REST API and as the `subdomain_find` tool on the MCP server. There is no key or signup, and the same limits apply.