Are you using HTTPS? It’s highly likely that your domains/certificates are being logged for certificate transparency. Unless you’re using wildcard domains, it’s very easy to enumerate your sub-domains.

I once had HR ask if I was familiar with G-I-T ( she spelled it out), for a moment, my only thought was “wtf is G-I-T”.