How to Find All Subdomains of a Website (Free Methods)

To find all subdomains of a website, pull them from three sources at once: certificate transparency logs (like crt.sh), passive DNS databases, and search engine indexes. No single source is complete, so you combine them and remove duplicates. A tool like Domain Intel does all three in one pass, but you can also do it by hand. Here is exactly how.

Why would you want to find subdomains?

Subdomains show how a site is actually built. You will spot admin panels, staging servers, API endpoints, mail gateways, and forgotten marketing microsites. For founders doing competitor research, the subdomain list reveals which products a rival runs, what they host, and where they keep their docs and status pages.

• app. and dashboard. point to the product itself
• api. and cdn. show the technical stack
• blog., help., and docs. reveal content and support strategy
• staging. or dev. are often left exposed by accident

How do you find subdomains of a website for free?

Start with certificate transparency. Every time a site issues an HTTPS certificate, the hostname gets logged in a public ledger. Those logs list exact subdomains that never appear in Google.

1. Open crt.sh and search for %.example.com. The % is a wildcard that catches every host.
2. Copy the Common Name and Matching Identities columns into a text file.
3. Search the same domain on a passive DNS source such as SecurityTrails or VirusTotal to catch hosts that never got a public certificate.
4. Run a search dork like site:example.com -www to pull indexed subdomains from Google or Bing.
5. Merge every list, sort it, and delete duplicates. That combined set is your answer.

What about active enumeration?

The steps above are passive. They read public records and never touch the target. If you own the domain, you can also go active and brute-force common names against DNS. Feed a wordlist of prefixes like mail, vpn, git, test, and beta to a resolver and keep the ones that return a record. Only do this on sites you control or have permission to test.

How does this connect to AI visibility?

Here is the part most founders miss. When someone asks ChatGPT or Perplexity about your space, the AI often names a competitor instead of you. Mapping a rival's subdomains shows you their full footprint: the docs, the comparison pages, the help center that AI models actually read and cite. Those pages are why they get recommended and you do not.

Once you know what a competitor publishes, you can close the gap. Check where you stand first with a free AI visibility test, then build the pages AI engines cite. That is the real payoff of subdomain research: not trivia, but a map of what wins the answer.

Quick recap

• Combine certificate logs, passive DNS, and search dorks. No single source is complete.
• crt.sh with %.domain.com is the fastest free starting point.
• Merge and dedupe every list for a full picture.
• Use active brute-force only on domains you own.
• Turn the competitor map into cited pages so AI recommends you, not them.

Ready to run it? Start with Domain Intel, then work through your own gaps with a free SEO audit.