How to Find Every Subdomain of a Domain (5 Methods Compared)
"Every subdomain" is a slightly misleading goal, since no method finds all of them and new ones appear constantly. What you actually want is the widest practical coverage in the least time. Here are the five methods people actually use, what each one is good at, and where each one falls short.
Method 1: Certificate Transparency search
Every TLS certificate issued by a public certificate authority gets logged to a Certificate Transparency log, and every hostname on that certificate becomes searchable. Tools like crt.sh let you query %.example.com and get back every subdomain that ever had a certificate issued for it. This is entirely passive: no traffic ever reaches the target's servers.
The catch is coverage bias. CT search only reveals subdomains that have been issued a public TLS certificate at some point. Internal-only services on private certificates, or subdomains that only ever used plain HTTP, will not show up here at all.
Method 2: Passive DNS aggregators
Passive DNS services collect historical DNS answers observed by resolvers across the internet and let you search them by domain. Services like RapidDNS, HackerTarget, and AlienVault OTX fall into this category. Because they are built from actual DNS resolution history rather than certificates, they can surface subdomains that never had a public certificate at all.
The tradeoff is staleness and gaps: a passive DNS record only exists if some resolver, somewhere, happened to look up that hostname and the aggregator happened to capture it. Freshly created subdomains, or ones that only get queried internally, are often invisible here too.
Method 3: Active DNS brute-force
Active brute-force takes a wordlist of common subdomain names (dev, staging, api, vpn, and thousands more) and resolves each candidate directly against the target's DNS. Anything that resolves is a confirmed live subdomain. This method finds hosts that passive sources never recorded, because it does not depend on any historical record existing anywhere.
The downside is that it sends real DNS queries to the target's infrastructure, so it is active reconnaissance rather than passive, and its coverage is entirely limited by the wordlist. A subdomain with a name nobody guessed simply will not be found this way.
Method 4: Search engine dorking
Using search operators like site:example.com -site:www.example.com against Google or Bing surfaces subdomains that got indexed because they had public, crawlable content and inbound links. This method is free, requires no tooling, and occasionally turns up forgotten marketing microsites or old documentation portals that nothing else catches.
It is also the least systematic method here. Search engines index based on crawl priority and link popularity, not completeness, so dorking is best treated as a supplementary check rather than a primary method.
Method 5: All-in-one merged tools
A tool that queries multiple passive sources and runs active brute-force in parallel, then deduplicates the combined results, consistently finds more than any single method run alone. This is the approach Subdomain Finder takes: it merges Certificate Transparency data, several passive DNS sources, and active resolution into one result set, so you are not stuck manually cross-referencing five different tools.
Coverage compounds, it does not average
Each method here catches subdomains the others miss. A domain with 40 subdomains might show 22 via crt.sh, 19 via passive DNS with only partial overlap, and 6 more only via brute-force. Merging typically finds more than any individual source by a wide margin.
Comparison table
| Method | Speed | Coverage | Setup |
|---|---|---|---|
| Certificate Transparency | Fast (seconds) | High for certified hosts | None |
| Passive DNS aggregators | Fast (seconds) | Medium, depends on capture history | None |
| Active brute-force | Slow (minutes) | Depends entirely on wordlist | Wordlist and tooling |
| Search engine dorking | Manual, fast per query | Low, indexed content only | None |
| All-in-one merged tool | Fast (parallel queries) | Highest, combines all sources | None |
Skip the five separate tabs
Subdomain Finder runs Certificate Transparency search, passive DNS aggregation, and active brute-force together in one scan, then merges and deduplicates automatically.
Try a scan free →Frequently asked questions
What is the fastest way to find subdomains?
Querying Certificate Transparency logs or a passive DNS aggregator is fastest, since both return results in seconds without sending any traffic to the target's own servers.
What is the most complete way to find subdomains?
No single method finds everything. Combining passive sources with active DNS brute-force catches both subdomains that have public records and ones that were never indexed anywhere, which is why merged tools consistently outperform any single method.
Is brute-forcing subdomains slower than other methods?
Yes, generally. Active brute-force has to resolve each candidate hostname individually against DNS, so a large wordlist can take minutes, compared to seconds for a passive lookup, though it can find subdomains passive sources never recorded.