Find the Forgotten Subdomains Still Pointing at Your Business
Every certificate ever issued for your domain is recorded in a public log.
AI summary
This document is a training preview that explains how public certificate logs can be used to identify forgotten subdomains that may be active and running outdated software. It highlights the security risk of maintaining unmonitored subdomains and outlines the intent to demonstrate how to retrieve these lists and manage unexpected findings.
- This text is a training preview and does not contain actual training videos or completed lessons.
- Public logs record every certificate issued for a domain, making subdomains discoverable.
- Forgotten subdomains, such as old staging sites, may still be online and running outdated software.
- The content intends to explain how to list a domain's subdomains and address unexpected results.
About this training
Every certificate ever issued for your domain is recorded in a public log. That means anyone can list your subdomains — including the staging site from the redesign three years ago that is still online, still running old software, and still pointing at your business.
This shows you how to pull that list for your own domain, and what to do about anything on it you did not expect.
Put this training into practice
Talk with ALCO about how this guidance applies to your organization, your systems and the support your team needs.