Subdomain Finder Tool

Passive subdomain enumeration

Find subdomains via certificate transparency and passive DNS. Discovered hostnames are saved to your domain list and trigger DNS record lookups.

Scale at your fingertips. Subfinder taps certificate transparency, passive DNS, and dozens of sources to uncover subdomains others miss. We are still adjusting ratelimits, and how frequently we poll the results. Please be patient, and provide us feedback if you encounter any issues.

Subdomain Finder

Enter a root domain to enumerate subdomains from CT logs, passive DNS, and dozens of other sources.