Search Certificate Transparency (CT) logs for a domain's subdomains. Check each subdomain's DMARC on the spot. Free, no sign-up.
The Subdomain Finder searches Certificate Transparency (CT) logs for subdomains associated with a domain. It queries two independent sources — crt.sh and certspotter — in parallel and merges the results with deduplication. Results are cached for up to 2 hours. Free, no sign-up required.
Important: what CT logs do and don't cover
This tool shows subdomains found in CT logs (public TLS certificates). It is not a complete inventory of all subdomains. Please note:
• Subdomains that don't use HTTPS (no TLS certificate) will not appear.
• Internal-only or intranet subdomains are typically not logged.
• Stale entries from expired or revoked certificates may be included — a subdomain may appear even if it no longer resolves.
• Self-signed certificates are not recorded in CT logs.
Results show the list of discovered subdomains and which CT log sources provided the data (crt.sh / certspotter). After you click the DMARC button next to a subdomain, the dot on the left updates to green (protected), yellow (partial/monitoring), or red (unprotected).
Not all of our subdomains appear. Why?
CT logs only record subdomains for which a TLS certificate was issued through a public CA. Subdomains running plain HTTP, internal-only hosts, and those using self-signed certificates are not in the logs and therefore won't appear here. For a complete inventory, consult your internal DNS zone files.
A subdomain appears that we decommissioned. Why?
CT logs are immutable records of past certificate issuances. Even after a certificate expires or a DNS record is removed, the log entry remains. This tool cannot determine whether a listed subdomain currently resolves in DNS.
Many subdomains show as "unprotected" in the DMARC check. Is that a problem?
Subdomains without their own _dmarc record inherit the organisation domain's DMARC policy (RFC 7489 §6.6.3). This tool evaluates inheritance correctly — if the org domain has p=reject, the subdomain is shown as "protected".
The search is slow on the first run.
The first search queries crt.sh and certspotter in parallel, which can take a few seconds. Subsequent searches for the same domain return from cache instantly (2-hour cache).