# Subdomain Finder

> Free web tool for enumerating subdomains from Certificate Transparency
> logs and passive DNS, then checking live status, redirect chains, and
> subdomain takeover risk. No account required for scanning.

Subdomain Finder merges seven sources (crt.sh, CertSpotter, HackerTarget,
Wayback Machine, AlienVault OTX, RapidDNS, and active DNS brute-force)
into one deduplicated list, then live-checks each host: HTTP status,
redirect chain, TLS certificate, WAF/bot-protection detection, and whether
a dangling CNAME leaves the subdomain open to takeover.

Scanning, live status checks, and subdomain takeover detection are free
with no signup. A free account additionally unlocks a dashboard, favorites,
scheduled monitoring with webhook/email alerts, DNS/TLS and
security-posture inspection (CAA, SPF, DMARC, DKIM, DNSSEC), port scanning,
and real browser screenshots of discovered hosts.

Built and maintained by Pritam Sonone (https://www.digitalpritam.in).

Intended use: security research, bug bounty reconnaissance, and asset
discovery on domains the user owns or is authorized to assess.

## Pages

- [Homepage](https://subdomainfinder.org/): the scanner itself, plus a "How
  it works" explanation and FAQ.
- [Blog](https://subdomainfinder.org/blog): guides on subdomain
  enumeration, Certificate Transparency, subdomain takeover, and DNS
  security.

## Blog posts

- [What Is a Subdomain Takeover? How to Check and Fix It](https://subdomainfinder.org/blog/subdomain-takeover-guide):
  a dangling DNS record can let an attacker take over your subdomain, how
  the attack works, how to check for it free, and how to fix it.
- [Why crt.sh Times Out (and the 7 Sources That Do Not)](https://subdomainfinder.org/blog/why-crt-sh-times-out):
  why the most relied-upon Certificate Transparency search tool struggles
  under load, and how merging 7 sources instead of relying on one fixes it.
- [Is Subdomain Enumeration Legal? A Straight Answer](https://subdomainfinder.org/blog/is-subdomain-enumeration-legal):
  when subdomain enumeration is legal, the difference between passive and
  active recon, and how scope and authorization change the picture.
- [How to Find Every Subdomain of a Domain (5 Methods Compared)](https://subdomainfinder.org/blog/how-to-find-every-subdomain):
  five real methods for finding a domain's subdomains, compared on speed,
  coverage, and setup.
- [Certificate Transparency Logs Explained for Beginners](https://subdomainfinder.org/blog/certificate-transparency-logs-explained):
  what Certificate Transparency logs are, why they exist, how anyone can
  query them, and why they matter for subdomain discovery.
- [Passive DNS vs. Active Reconnaissance: What's the Difference](https://subdomainfinder.org/blog/passive-dns-vs-active-recon):
  how passive DNS and active reconnaissance find subdomains differently,
  with different stealth, speed, and legal tradeoffs.
- [SPF, DKIM, DMARC, and DNSSEC: A Practical Checklist](https://subdomainfinder.org/blog/spf-dkim-dmarc-dnssec-checklist):
  what each protocol actually protects against, a practical checklist for
  verifying each, and why forgotten mail-sending subdomains slip through.
- [Bug Bounty Recon 101: Subdomain Enumeration Methodology](https://subdomainfinder.org/blog/bug-bounty-recon-101):
  a practical subdomain enumeration methodology for bug bounty hunters,
  from scope review through prioritization.
- [Best Free Subdomain Finders in 2026 (Tested, No Signup)](https://subdomainfinder.org/blog/best-free-subdomain-finders-2026):
  a tested comparison of free subdomain enumeration tools, on signup
  requirements, speed, takeover detection, and export options.
- [Attack Surface Management for Small Teams (No Enterprise Budget)](https://subdomainfinder.org/blog/attack-surface-management-small-teams):
  what attack surface management means and a lightweight, free-tool
  routine for tracking subdomains, takeovers, and exposed panels.
- [How to Detect a Dangling CNAME Before an Attacker Does](https://subdomainfinder.org/blog/detect-dangling-cname):
  what a dangling CNAME is, common vulnerable services, and a
  step-by-step manual and automated detection process.
- [Cloudflare Is Blocking My Scanner: What "Protected" Status Means](https://subdomainfinder.org/blog/cloudflare-blocking-my-scanner):
  why a Cloudflare challenge page is not the same as a dead subdomain, and
  how to correctly interpret a protected status.