Subdomain Enumeration: Finding Your Forgotten Subdomains Before Attackers Do

Most organizations have more subdomains than anyone currently working there remembers creating. Staging environments, old marketing microsites, internal dashboards spun up for a project that ended years ago — they often stay reachable long after everyone's forgotten they exist.

Why This Is a Real Risk

A forgotten subdomain is frequently running older, unpatched software, since nobody's actively maintaining it anymore. It may also still have valid DNS records pointing to a cloud resource that's since been deleted — a setup that leads directly into subdomain takeover, a separate and more severe risk.

How Certificate Transparency Logs Help

Every publicly trusted SSL certificate ever issued gets logged in public Certificate Transparency logs, as a safeguard against fraudulently issued certificates. A useful side effect: searching those logs for your domain reveals every subdomain that's ever had a certificate issued for it — including ones nobody remembers.

What to Do With the List

Once you have a full list, the next step is simple triage: is this subdomain still needed? If yes, make sure it's patched and monitored like anything else. If no, the DNS record should be deleted entirely rather than left pointing at nothing.

Common mistakes with subdomain inventory

Treating subdomain enumeration as a one-time setup task instead of a recurring check. Development, staging, and demo subdomains get spun up constantly by different teams — an inventory done once at launch is stale within weeks on any actively developed product.

Finding an old subdomain and just leaving its DNS record in place because 'it's not doing any harm.' A dangling record pointing at a deprovisioned cloud resource is precisely the setup that leads to subdomain takeover, covered in more detail in a related guide below.

Run a Scan

Nexora Shield's Subdomain Finder searches certificate transparency logs for any domain and lists every subdomain it finds, in seconds.