Subdomain Finder
Discover a domain's subdomains — no scanning or brute-forcing required. Useful for mapping an organization's services and attack surface.
Searching for subdomains, please wait...
CLI Usage
curl nettools.me/subdomains?q=example.com
How the subdomain finder works
nettools.me finds subdomains passively. Instead of scanning or brute-forcing a domain, it queries an index of hostnames observed in public Certificate Transparency (CT) logs. Every trusted Certificate Authority must publish each TLS certificate it issues to these public logs, and each certificate lists the hostnames it covers — so any subdomain that has ever had an HTTPS certificate leaves a permanent, public trace.
Because the lookup reads existing public records rather than probing the target, it is instant, sends no traffic to the domain you search, and cannot be blocked by a firewall or rate limiter. It is the same technique used in security reconnaissance and attack-surface mapping, offered here as a free tool backed by an index of over a billion hostnames.
The trade-off is coverage: a subdomain only appears once a public certificate has been issued for it (directly or via a wildcard). Purely internal hosts, or names that have only ever used self-signed certificates, will not show up. For the broadest picture, combine the results with a DNS lookup and a reverse-IP search.
Frequently asked questions
How do I find all the subdomains of a domain?
Enter the apex domain (for example example.com) above and nettools.me returns the subdomains it knows about instantly. It works by querying an index of hostnames seen in public Certificate Transparency logs, so there is no port scanning, brute-forcing, or wordlist involved.
Where does the subdomain data come from?
From Certificate Transparency (CT) logs — the public, append-only logs that every trusted Certificate Authority must publish every certificate to. Our index holds over a billion hostnames seen in those certificates, so lookups are passive and instant.
Is subdomain enumeration legal?
Yes. This tool only reads public Certificate Transparency records and public DNS. It never scans or connects to the target domain, so it is purely passive reconnaissance using data that is already public.
Why do some subdomains not appear?
A subdomain only shows up once a public TLS certificate has been issued for it (or covered by a wildcard). Internal hosts that have never had a public certificate are not in Certificate Transparency logs and cannot be discovered this way.