DNSdumpster.com - dns recon and research, find and lookup dns records
Exposure Management and Threat Hunting Solutions | Censys
Use through the web app or The Harvester (included with Kali)
https://github.com/christophetd/censys-subdomain-finder
This is a tool to enumerate subdomains using the Certificate Transparency logs stored in Censys Search. It should return any subdomain who has ever been issued a SSL certificate by a public CA.
Requires Censys API key