# How to Find Forgotten Subdomains

> A practical process for discovering, validating, and retiring forgotten public subdomains.

Canonical: https://sentryxmonitor.com/learn/external-attack-surface-management/how-to-find-forgotten-subdomains/
Last updated: 2026-08-08

External attack surface management

Forgotten subdomains are best found by combining DNS enumeration, certificate transparency, historical records, code searches, and external service observations, then validating each candidate before acting.

Reviewed 2026-08-08 Read-only educational guidance

## Key points

- No single discovery source is complete.

- A DNS name may remain after the application is gone.

- Validation prevents false ownership claims.

## What is find forgotten subdomains?

Forgotten subdomains are best found by combining DNS enumeration, certificate transparency, historical records, code searches, and external service observations, then validating each candidate before acting.

## How does it work?

Start with certificate names and DNS sources, add passive historical data, and resolve each candidate. Check HTTP and TLS behavior, but do not assume every shared-hosting result belongs to the organization.

## What can go wrong?

Forgotten subdomains can point to decommissioned infrastructure, abandoned SaaS tenants, expired certificates, or unmaintained applications. Stale third-party mappings can also create takeover conditions in some platforms.

## How can teams detect the problem?

Record the DNS type, target, resolving IP, certificate names, HTTP status, first seen time, and last seen time. Ask the likely owner to confirm purpose and lifecycle.

## How can teams improve the situation?

Remove stale records, reclaim or disable abandoned vendor resources, redirect intentionally retired names, and add lifecycle checks to DNS change processes.

## What does a technical example look like?

```
old-app.example.com CNAME old-tenant.vendor.example
Result: vendor target no longer provisioned
Action: verify ownership, remove stale DNS, document closure
```

The example uses reserved documentation domains and addresses. Apply the same reasoning to systems you own or are authorized to assess.

## Authoritative technical references

- [RFC 9162: Certificate Transparency Version 2.0](https://www.rfc-editor.org/rfc/rfc9162.html)

## How does continuous monitoring help?

A point-in-time check explains the observed state now. [Continuous monitoring](https://sentryxmonitor.com/services/uptime-monitoring/) establishes an expected baseline, repeats the relevant check, and records meaningful state changes so an owner can investigate before a small configuration drift becomes a prolonged security or availability problem. See [External Attack Surface Management](https://sentryxmonitor.com/learn/external-attack-surface-management/) for the surrounding technical context.

## Where does Sentryx Monitor fit?

Sentryx Monitor provides [read-only outside-in discovery](https://sentryxmonitor.com/services/external-attack-surface-monitoring/) and monitoring for public hosts, DNS, HTTPS, TLS certificates, baseline security headers, email-security records, and selected network services. It supports evidence and operational follow-up, but it does not replace authorized penetration testing, authenticated vulnerability assessment, or owner validation.

## Continue learning

- [External Attack Surface Management: A Practical Guide](https://sentryxmonitor.com/learn/external-attack-surface-management/) - Learn what EASM is, how external assets are discovered, how exposure changes, and how continuous monitoring supports an accurate internet-facing inventory.

- [What Is External Attack Surface Management?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-easm/) - A clear explanation of EASM, its workflow, scope, and relationship to continuous security monitoring.

- [What Is an External Attack Surface?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-an-external-attack-surface/) - Understand which public assets make up an external attack surface and why the inventory changes over time.

- [How Attackers Discover Internet-Facing Assets](https://sentryxmonitor.com/learn/external-attack-surface-management/how-attackers-discover-internet-facing-assets/) - Learn the public signals attackers use to find domains, subdomains, IP addresses, certificates, and exposed services.

## Related
- [Home](https://sentryxmonitor.com/)