Find every subdomain
of any domain.

Every HTTPS certificate a public certificate authority issues is recorded in certificate transparency logs, with every name it covers. The finder reads those logs for the domain, lists each subdomain that has appeared on a certificate, then looks up the 200 most recently seen in DNS to show its IP address and whether it still resolves.

Only names that have had a publicly trusted certificate show up. A subdomain that only ever served plain HTTP, is covered by a wildcard certificate (*.example.com), or only exists on an internal network never appears in the logs. A wildcard certificate for *.api.example.com is listed as api.example.com.

Doesn't exist means DNS has no record of the name at all, so it was removed after its certificate was issued. No address means the name exists in DNS but has no IPv4 or IPv6 address, for example when it only has a mail or text record. Either way, browsers can't reach a website there.

Forgotten subdomains are worth a look. A name that still points at a service you no longer use, like a deleted cloud app or storage bucket, can sometimes be claimed by someone else and serve their content on your domain. Removing DNS records you no longer need keeps your domain tidy.

The certificate logs are read once a day per domain, so a certificate issued in the last day can be missing. The DNS lookups run every time you search, so whether a name resolves is always current.

It lists up to 1,000 subdomains per domain, most recently seen first, and checks the DNS of the 200 most recent. You can search 20 domains an hour without an account, and 300 a day with a free account through the API and MCP server.

Yes. The Lemon Domains MCP server has a find_subdomains tool, the REST API serves the same search at GET /api/v1/subdomains, and the lemon CLI runs it with lemon subdomains example.com. Agents can also fetch lemon.domains/tools/subdomain-finder/example.com.md with no account.