Glossary
Subdomain
A subdomain is a name published below a domain — `shop.example.com` under `example.com` — and it is a separate host as far as browsers, certificates and search engines are concerned. It can point at entirely different infrastructure, and its own DNS records are independent of the parent's. What it does share with the parent is more limited than most people expect: cookies and some security policies cross the boundary, content signals largely do not.
What a subdomain shares with its parent
The registrable domain, which is what cookie scoping and the same-site rules are based on. A cookie set with `Domain=example.com` is sent to every subdomain.
Strict-Transport-Security with `includeSubDomains`, which applies the parent's HTTPS requirement across the whole tree.
CAA records, which are inherited upward when a subdomain publishes none of its own.
Registration and expiry: every subdomain disappears when the parent domain lapses, regardless of how it is hosted.
What it does not share
The TLS certificate. A certificate for `example.com` does not cover `shop.example.com` unless that name is listed in it, or a wildcard covers that level.
The web origin. Browsers treat `shop.example.com` and `example.com` as different origins, so cross-origin rules apply between them.
DNS records below the apex: address records, MX records and everything else are published independently.
Server configuration, which may be an entirely different machine run by an entirely different provider.
Subdomain or subdirectory, for content
Google treats both as part of the same site and states it can handle either. There is no ranking rule that prefers one.
The practical differences are operational: a subdirectory shares the host's configuration, certificate and analytics automatically; a subdomain can be hosted separately, which is why a blog on a hosted platform usually ends up as one.
A subdomain needs its own certificate coverage, its own security headers, its own redirect rules and its own entries in the sitemap. Each of those is a place where it can silently fall behind the main site.
That drift is the real cost. Audits of large sites very often find a subdomain still serving plain HTTP, or with an expired certificate, because nobody owned it.
How to find the subdomains you have
There is no DNS query that lists them. Zone enumeration is not possible in a well-configured zone, which is deliberate.
Certificate Transparency logs are the practical source: every publicly trusted certificate issued for a name is logged, so names that have ever had one are discoverable.
Your own DNS provider's interface lists what you publish, which is authoritative for your zone even though it misses names delegated elsewhere.
Links from your own site reveal the ones that are actually in use, which is usually a much shorter list than the ones that exist.
Frequently asked questions
- Is a subdomain better than a subdirectory for SEO?
- Google states it handles both and has no preference. The differences that matter in practice are operational: certificates, headers and configuration drift.
- Does my certificate cover my subdomains?
- Only if they are listed in it, or a wildcard covers that level. A certificate for the apex alone does not cover any subdomain.
- Do cookies set on the main domain reach subdomains?
- They do if the cookie sets a Domain attribute naming the parent. Without it, a cookie is sent only to the exact host that set it.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website