# DNS Subdomain Enumeration via Certificate Transparency

> DNS Subdomain Enumeration via Certificate Transparency is a paid API for AI agents from dns-intel-api-production.up.railway.app, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-14).

Discovers all known subdomains for an apex domain by querying Certificate Transparency logs (crt.sh), returning a de-duplicated, sorted list of up to 1000 results.

## Facts

- Endpoint: POST https://dns-intel-api-production.up.railway.app/dns/subdomains
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-subdomain-enumeration-via-certificate-transparency-65a631c1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y3hqrFuu0wZteUltiQbwF

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-subdomain-enumeration-via-certificate-transparency-65a631c1 -d '<json body>'
```

Example prompt: Can you enumerate all known subdomains for stripe.com using certificate transparency logs? Return up to 500 results.

## When to prefer this

Use this endpoint when you need passive, non-intrusive subdomain discovery without sending traffic directly to the target — ideal for reconnaissance, attack surface mapping, or security audits. Prefer it over active DNS brute-forcing when stealth matters or when you want a quick snapshot of publicly issued certificates. It complements sibling endpoints (WHOIS, DNS resolution, TLS cert details) for comprehensive domain intelligence.

## Known failure modes

- Invalid or non-existent domain returns empty list or error
- crt.sh upstream unavailability causes timeout or 502
- Limit parameter out of range (below 1 or above 1000) returns validation error
- Very new domains with no CT log entries return empty results
- Rate limiting from crt.sh may cause partial results or failure

## How this service works

Discover subdomains for a domain via Certificate Transparency logs (crt.sh); returns a de-duplicated, sorted list.

## Output

A de-duplicated, sorted list of subdomain strings discovered from Certificate Transparency log entries for the requested apex domain, capped at the requested limit (default 200, max 1000).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "limit": {
   "type": "integer",
   "maximum": 1000,
   "minimum": 1,
   "description": "Maximum number of subdomains to return. Defaults to 200."
  },
  "domain": {
   "type": "string",
   "description": "Apex domain to enumerate subdomains for via Certificate Transparency logs, e.g. 'example.com'."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-subdomain-enumeration-via-certificate-transparency-65a631c1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns-intel-api-production.up.railway.app](https://www.zero.xyz/host/dns-intel-api-production.up.railway.app/llms.txt)