Skip to main content
Book Consultation →
Domain tools100% FreeInstant

Subdomain Finder: Find the Subdomains of a Domain

This free subdomain finder tests several hundred common names, such as www, mail, api and dev, against the real name servers of a domain. It shows which ones exist, where they point and ignores wildcard answers.

By Debmedia Technologies LLP · Kolkata, India · Updated

What Is a Subdomain Finder?

A subdomain finder looks for the subdomains that exist under a domain, such as mail.example.com or api.example.com. Subdomains are separate addresses that a domain owner creates for a blog, a shop, an app, an email system or a test site. Knowing them helps you review your own setup and find forgotten hosts.

This subdomain finder tries several hundred common names. It asks the real name servers of the domain, which it finds from the root servers, so the answers are fresh and no public resolver is involved.

How to Use This Subdomain Finder

  1. Enter a domain such as example.com.
  2. Press Find subdomains. The test takes a few seconds.
  3. Read the list of names that exist, with their type, target and TTL.
  4. Read the notes for the name servers used and for wildcard records.

How It Works

StepWhat happens
1. Find the zoneThe tool walks down from the root servers to the servers that answer for your domain.
2. Test for a wildcardIt asks for a random name that cannot exist. If that answers, a wildcard record is present.
3. Try the listIt asks for each common name, such as www, mail, api, dev and staging.
4. Filter the resultsAnswers that only repeat the wildcard are hidden, and real ones are shown.

Subdomains are part of the naming system described in RFC 1034, which explains domain names and subdomains.

What It Cannot Find

DNS does not publish a list of its names. A subdomain finder that guesses can only find names that are easy to guess. A subdomain called x7-internal-tools will stay hidden. Services that find nearly everything rely on databases of past certificates or old DNS data, which are outside services we do not use.

Why Look for Subdomains?

  • Security review. Old test, staging or admin hosts left online are a common weak spot.
  • Migration checks. Make sure every host is moved, and none is left pointing at an old server.
  • Email setup. Check that mail, autodiscover and similar hosts exist as expected.
  • Competitor and brand research. See which services a public domain exposes.

Next Steps

For each name you find, read its full records with the DNS lookup tool, or follow an alias with the CNAME lookup. If a subdomain has no record that you expect, check the zone itself with the delegation test. Looking for new name ideas for another project? Try the domain name generator.

Run the subdomain finder again after any DNS change. Names you add show up at once, because the tool asks the authoritative servers and not a cache.

Frequently Asked Questions

No. DNS has no public list of names, so the tool can only find names that are easy to guess. Services that claim to find all of them use certificate logs or databases of past DNS data.
It gives fresh answers from the source, not cached ones, and it does not depend on any public resolver. The tool first finds the real name servers from the root servers.
A wildcard makes every name under a domain answer, even ones that do not exist. The tool detects it and hides answers that look like the wildcard.
Looking up public DNS names is normal. Still, test only domains you own or have a reason to review, and avoid heavy repeated use.

Disclaimer: results come from live requests and can change as records and servers change. We cannot guarantee that every answer matches what every visitor sees.