CT Subdomain Resolver

The CT Subdomain Resolver searches public Certificate Transparency (CT) logs for every subdomain a domain has issued a certificate for, then resolves each one to its current IPv4/IPv6 addresses. It produces a copy-paste FQDN list and IP list you can paste into a firewall or router that needs explicit hostnames or IPs instead of a wildcard like *.example.com.

This tool relies on free third-party discovery sources (Certificate Transparency logs and passive DNS) plus live DNS. By running a search you acknowledge that these services may be slow, rate-limited, or temporarily unavailable at the moment you search, and that results are a point-in-time snapshot that can change.

Why it matters

Many enterprise and SaaS platforms spread their service across many unpredictable subdomains behind the scenes. When a client's router or firewall can't match a wildcard, you need the explicit FQDNs (and often IPs) to allow. Since you don't own the vendor's domain, Certificate Transparency logs are the practical way to enumerate those hostnames from public data — every publicly-trusted certificate is logged, so most active subdomains show up.

Examples

A client can only reach part of a SaaS app because their firewall allowlists *.vendor.com but the router ignores wildcards — resolve the concrete subdomains and add them explicitly.
CT logs reveal hostnames that ever had a certificate, so the list can include retired hosts (which simply won't resolve) and can miss internal-only names or those covered solely by a wildcard cert.
For CDN-fronted vendors the resolved IPs rotate and are shared — prefer allowlisting the FQDNs where possible and re-run periodically to catch new subdomains.