Free · live registry data · no login

Subdomain Finder

Discover public subdomains of a domain.

How it works

Find the public subdomains of any domain

Enter a domain and we test the 40 most common subdomain names (www, mail, api, app, blog, shop, dev, staging, admin, vpn and more) with live DNS lookups, running them in parallel batches of ten. Each hit shows whether it is an A record or a CNAME, what it points to and which provider that reveals. We also detect wildcard DNS, which would make every name resolve. Use it to inventory your own attack surface or to see how a company has split its services.

Results appear here after you click Find subdomains.

How this works

1
Check for wildcards
A random subdomain is resolved first; if it answers, the zone has a wildcard and matching results are filtered out.
2
Resolve 40 common names
Each candidate is looked up over DNS-over-HTTPS for an A record, then a CNAME, in parallel batches of ten.
3
Classify each hit
Targets are matched to providers (Cloudflare, AWS, Shopify, Microsoft 365…) and names to purposes, with warnings for exposed environments.

Frequently asked questions

How do I find all subdomains of a domain?: There is no public list, so tools combine techniques: brute-forcing common names with DNS (what this tool does), reading certificate transparency logs, scraping search engines and passive DNS databases. For your own domain the authoritative answer is the zone file at your DNS provider.
Why does every subdomain I try resolve?: The zone has a wildcard record (*.example.com), so any name returns the same answer. We detect this by resolving a random string first and then hide results that only match the wildcard, leaving the names that point somewhere specific.
Is finding subdomains legal?: DNS lookups are public queries that every browser makes, so resolving names is legal and harmless. Probing the services behind them, scanning ports or attempting logins on systems you do not own is a different matter and may be illegal. Use this on domains you manage or for passive research.
What is a subdomain takeover?: When a CNAME points at a third-party service (Heroku, GitHub Pages, Shopify, a SaaS help desk) and the account there is cancelled, anyone can claim that hostname at the provider and serve content on your subdomain. Prevent it by deleting DNS records when you stop using a service.
Should staging and dev subdomains be public?: They are often reachable by necessity, but they should never be open. Protect them with HTTP authentication, SSO or an IP allowlist, add a noindex header, and keep them from holding real customer data. Attackers target staging because it lags production patches.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.