Find subdomains
How it works
Why Certificate Transparency finds what wordlists miss
Brute-force subdomain tools guess names from a list, so they only ever find hosts somebody thought to guess. Certificate Transparency works the other way round: since 2018 browsers have required that every publicly trusted certificate be logged, so any subdomain that has ever been given HTTPS is named in a public, append-only log. Internal-sounding names like staging, jenkins or vpn show up because someone issued a certificate for them, not because anyone guessed.
The corollary matters just as much: CT is a historical record. A hostname that appears in a certificate from three years ago stays in the log permanently, even after the DNS entry is deleted. That is why each result here is re-resolved — a name in CT proves the host once existed, not that it still does.
What to look for
| Finding | Why it matters |
|---|---|
| Staging, dev, UAT or test hosts that resolve | Non-production environments are routinely less patched and less monitored than production, and often hold real data. |
| cPanel, WHM, Plesk or webmail panels | Login surfaces. These also frequently sit on the real origin IP, bypassing whatever CDN protects the main site. |
| Mail hosts on a sending domain | Confirms which subdomains carry mail, and whether tracking or sending subdomains are separated from the root as they should be. |
| A subdomain pointing at a third party | If the CNAME target is no longer claimed, the subdomain can be taken over by whoever registers it next. |
| Names in CT that no longer resolve | Decommissioned infrastructure. Harmless in itself, but it maps how the estate used to be built. |
Where this fits on a sending fleet
Cold email estates accumulate subdomains: tracking domains, redirect hosts, landing pages, one-off campaign sites. Each one is a name that can be spoofed, and each one inherits the reputation of the parent domain. Knowing the full list is the first step to deciding what should still exist, what needs authentication records of its own, and what should be retired.
Once you have the list, check the ones that matter with the domain lookup and score their mail posture with the deliverability score.
Questions
Is this legal, and will the owner know?
Yes, and no. Certificate Transparency logs are public infrastructure that anyone can query, and reading them touches nothing belonging to the domain owner. The only request that reaches the target is a standard DNS resolution for each hostname, identical to what happens when anyone visits a site.
Why do some subdomains not resolve?
Because CT is permanent and DNS is not. A certificate issued years ago still names its hosts even after those hosts were deleted. Anything marked as not resolving existed at some point and does not now.
Will it find everything?
It finds every subdomain that has ever had a publicly trusted certificate. Hosts that only ever ran plain HTTP, sat behind an internal certificate authority, or were covered solely by a wildcard certificate will not appear. Wildcards are counted separately for that reason.
Why are only the first 30 resolved?
To keep the lookup fast and within a sensible query budget. The total count reflects everything found in CT; resolution is applied to the first 30 alphabetically.
More in this category
What to run next
The checks people most often reach for alongside this one.
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.