The domain is queried on crt.sh from our function, cached for one day. DNS checks go straight from your browser to Cloudflare. We store nothing.
Up to 30 selected names: looks up the A record of each one.
| Select | Name | First seen | Last seen | Valid | Issuer | Resolves |
|---|
How to use it
01
Type the domain
The root domain, without www. The search returns everything under it that ever had a public certificate.
02
Read the inventory
Each name shows the first and last time a certificate was issued, whether one is still valid and who issued it.
03
Check which ones live
Select the ones you care about and look up their DNS. A name with an expired certificate and no record is a forgotten subdomain.
What is certificate transparency?
A system of public, immutable, auditable logs where certificate authorities record every TLS certificate they issue. It was created to catch fraudulent certificates: if someone obtains one for your domain, it is out in the open. Since 2018 browsers reject any certificate that is not logged.
The side effect is a complete history of the names a domain has had. That is why the four-year-old staging environment and the subdomain of the provider you stopped using show up: nobody removed them from the logs because the logs cannot be edited.
What is it for?
- Inventory
- Before migrating, know which names really exist and which need redirecting or retiring.
- Forgotten
- Subdomains with expired certificates still in DNS, pointing at a service that is no longer yours.
- Takeover
- A CNAME to a cancelled provider is a name someone else can claim under your domain.
- Competitors
- A competitor’s subdomains reveal which tools they use: “shop.”, “app.”, “careers.”.
What nobody remembers is what breaks in the migration
Every migration starts here for us: the subdomain list crossed with DNS and with the old URLs. It is how you find the form still living on a 2019 subdomain, the CNAME to a cancelled provider and the staging environment indexed by Google.
And under support, it gets reviewed periodically: an orphaned subdomain is a security problem that gives no warning until someone uses it.
Frequently asked questions
Do all subdomains appear?
Only those that have had a public TLS certificate. A subdomain served over plain HTTP, or using an internal certificate, is not in the transparency logs. In practice, since 2018 almost everything published carries a certificate, so the list is usually more complete than the one the team itself remembers.
Why do subdomains that no longer exist appear?
Because transparency logs are never deleted: a certificate issued in 2019 for “staging.yourdomain.com” will still be there even if the environment was shut down a month later. That is exactly what makes the tool useful for inventory: it shows what there was, not only what there is. The “Valid” column and the DNS check separate the living from the historical.
What is a wildcard certificate?
One issued for “*.yourdomain.com”, covering any first-level subdomain without naming it. It appears as a separate entry because it says something different: that a certificate exists which can serve any name, but not which ones are in use. If a domain only has wildcards, this tool cannot list its subdomains.
Is it legal to look up the subdomains of someone else’s domain?
Yes: certificate transparency is public by design, precisely so anyone can audit which certificates are issued for a domain and spot fraudulent ones. This tool only reads those public logs. What is not acceptable is using the list to attack systems that are not yours.
How do I keep my internal subdomains from showing up here?
With public certificates, you cannot: anything issued by Let’s Encrypt or any other recognised authority gets logged. The two ways out are a wildcard certificate, which covers subdomains without naming them, or an internal certificate authority for what must not be visible from outside. And, in any case, no sensitive names in DNS.
What is a subdomain takeover?
A subdomain that points via CNAME to an external service (a host, a CDN, a marketing tool) that was cancelled without deleting the record. Whoever creates an account on that service and claims the name starts serving content under your domain. This list, crossed with the DNS check, is how you find those names before someone else does.
Is the domain I look up stored?
The crt.sh query goes through our function to get around the browser’s cross-origin block, and is cached for a day so crt.sh is not hit with the same question; who asked is not logged. DNS checks go straight from your browser to Cloudflare’s resolver.
How many subdomains do you have that you do not remember?
The inventory is the first step. Deciding which to redirect, which to retire and which are a risk is the work we do before touching a DNS record.
We reply within one business dayBogotá · UTC−5