You are using the wrong tool for the Job!
Subdomains are not private. They can't be made private either. The reason why they can't be is because of DNS, or Domain Name System. Without going into too much detail, DNS is a database of all domains and subdomains, and values associated to them. A very simple example:
User: "DNS Resolver, which IP does security.stackexchange.com have?"
DNS: "Hello User, I have the following addresses for security.stackexchange.com:"
User: "Thank you!"
What if you wanted to make sure that a subdomain would remain secret? Well, you couldn't, because the DNS database would still need to know about it. How else would anyone connect?
How to design it instead
What you actually want to do is secure a subdomain so that only specific people have access to it. One way to do it is a traditional password-based login, which gives you a session and authenticates and authorizes you to access the protected content.
Another, perhaps more elegant way, would be to use Client Certificates. You can generate a Certificate Authority and sign as many Client Certificates as you need. These Certificates would only be valid as long as you want them to be (e.g. 2 weeks, 1 month, 1 year, etc.) and can be revoked whenever necessary.