CT Subdomain Resolver
Related tools
This tool relies on free third-party discovery sources (Certificate Transparency logs and passive DNS) plus live DNS. By running a search you acknowledge that these services may be slow, rate-limited, or temporarily unavailable at the moment you search, and that results are a point-in-time snapshot that can change.
Frequently asked questions
- What does the CT subdomain resolver do?
- It searches public Certificate Transparency logs for subdomains of your domain that have ever been issued an SSL/TLS certificate, then resolves each to its current IP addresses — handy for building router or firewall allowlists.
- How do I use it?
- Enter your domain, pick how many subdomains to resolve (10–200, or All), and run it. Then copy the resulting FQDN or IP list into your router, firewall or allowlist.
- What does the resolve count do?
- It caps how many discovered subdomains are actually looked up. Higher counts take longer; “All” resolves as many as allowed, up to a safety cap of 500 per request.
- Why is “All” capped, and is the tool rate-limited?
- To keep the service responsive, each request resolves at most 500 subdomains, in small concurrent batches (12 at a time), and the endpoint is rate-limited per visitor. Very large domains may need more than one run.
- Where does the subdomain data come from?
- From public Certificate Transparency logs (such as crt.sh). It only sees names that appeared in issued certificates — not your full DNS zone — so some subdomains may be missing, and stale certificates can list hosts that no longer resolve.