Find the subdomains of a domain name

How to use the tool

Enter a domain name, with or without “www”, then click “Search”. The server queries crt.sh, a public search engine for certificate logs, and falls back on the Cert Spotter API if crt.sh does not answer. It then groups every name found by subdomain: a name cited in ten certificates makes a single row. The result for a domain is kept six hours on the server, so these services are not queried on every visit.

Tick the DNS option to know whether each name still answers today. The tool then asks for the A, AAAA and CNAME records of 200 names at most. A name that answers has at least one of these records, which says nothing about the content served behind it. The filters narrow the list (text, DNS state, wildcards, likely test names, age of the latest certificate) and the CSV file repeats the rows shown. The tool accepts 20 searches per 10-minute window and per visitor, and the table shows the first 500 rows of a filtered list.

Where the names come from: Certificate Transparency

Certificate Transparency is a system of public logs, open to everyone, where TLS certificates issued by public certificate authorities are recorded. RFC 6962 describes them as publicly auditable, append-only logs of all issued certificates, and expects authorities to submit their newly issued certificates to them.¹ The goal is to let the holders of a name found in a certificate notice an issuance they did not expect. The logs detect nothing by themselves: domain owners are the ones who monitor them.¹

RFC 9162 replaced RFC 6962 in December 2021 with a version 2.0 of the protocol. Both documents have Experimental status at the IETF.² For an SEO, the interest is a side effect: every logged certificate cites the names it covers, so a list of subdomains can be read in these logs without touching the site.

crt.sh and Cert Spotter are two ways to query this data. Cert Spotter documents its public API: the include_subdomains parameter returns all descendant subdomains of the domain requested, and queries without an account are limited per hour.³ The tool chains them so the search succeeds even when one of the two is slow.

Reading the table

Each row is a unique name. The first two dates are the validity start of the oldest and of the most recent certificate that cites the name, and the third is the latest validity end. The first certificate seen is therefore not the creation date of the subdomain: a name can exist for a long time without a certificate. The “Certificates” column counts the logged entries that cite the name, renewals included, which is why an active site piles up many.

The “Wildcard” column flags a name covered by a wildcard certificate, written *.example.com. Such a certificate protects every subdomain of one level without naming them: a subdomain that only appears inside a wildcard is not spelled out, and the tool marks it “wildcard only”. The DNS column, if the option is ticked, separates the names that answer, those with no record left and those that were not checked.

A name is flagged “possible test environment” when one of its parts contains a word from the tool’s list: dev, test, staging, stage, preprod, recette, beta, demo, qa, uat, sandbox, preview, integration, old or ancien. This list is the tool’s own landmark, no source imposes it, and a name without these words can be a staging site too.

Why list subdomains for SEO

A site grows, teams launch a blog, a shop, a campaign page, then forget it. The list of subdomains works as an inventory before an audit, a migration or a site purchase. Three situations come back.

The first is the forgotten subdomain that stays online. As long as it answers, Google can discover and crawl it like any address. To remove a page from search, Google recommends removing it or protecting it with a password, which also keeps Googlebot out; a noindex tag only removes the page from Google results, and visitors or engines that ignore it can still read the page. Google advises against using robots.txt for this.⁶ A listed name that no longer resolves in the DNS can no longer be crawled, a name that still answers deserves a check, for example with the indexability checker.

The second is the exposed test environment. Names like recette or staging can get a real certificate so the site works over https, so they enter the logs and this list. If they are reachable without credentials, they can be crawled and indexed like the rest. A password is Google’s answer for keeping crawlers out of a page.⁶

The third is dispersion. John Mueller said in May 2018 that Google sees subdomains and subdirectories the same way, that he would personally keep a single site together on a single domain as much as possible, and that he would use a subdomain for content that is really different.⁵ The list shows whether the site has scattered into blogs and micro-sites that would belong in one set.

It also serves Search Console. A Domain property gathers the data of all the subdomains, protocols and paths of the domain; it is declared with the bare domain, and verification goes through a DNS record.⁴ To follow a subdomain separately, Google suggests creating a URL-prefix property or filtering the performance report.⁴ Knowing which subdomains exist helps decide which ones to follow.

What the list does not show

The list only holds the names that received a public certificate recorded in the logs. A subdomain without https, an internal name, a service that only uses a wildcard certificate or goes through a private certificate does not appear, or only as a wildcard. A listed name may also no longer exist: a certificate stays logged forever, even after the site closes. The DNS option corrects this partly without settling it: a name can keep a record while nothing is served any more.

Both sources may also truncate an answer on a very large domain. The tool says so when it notices, and the list is limited to 2,000 names. It comes as a complement to a site crawl and its sitemap.

After the list

For each name that answers, the indexability checker says whether the page can appear in Google’s index, and the CMS, DNS and hosting tool shows which server and technology it runs on. An inventory of subdomains is part of the review I carry out before a redesign, a topic I cover in the SEO support I provide to my clients.

Frequently asked questions