How many of my subdomains should I be checking?

All of them, because an attacker will. The usual small business surface is larger than the owner expects:

• The website is one host - the mail server, the app portal and the staging site are others.
• Old ones are the risk - a forgotten subdomain still pointing at a decommissioned service is the classic takeover route.
• A DNS export is the fastest inventory - your provider can list every record on the domain in one view.

Red Bridge Cyber plans cover up to four hosts per domain for exactly this reason: the main site is rarely the whole picture.