Recon
puredns: resolve and bruteforce subdomains without wildcards
puredns is a fast domain resolver and subdomain bruteforcing tool that uses massdns for bulk DNS lookups and filters out wildcard subdomains and DNS-poisoned entries by validating answers against trusted resolvers.
installgo install github.com/d3mondev/puredns/v2@latest
Go · GPL-3.0 license
overview
What puredns does
This is the recon tool that wraps massdns — not the puredns.org hosted DNS service. Wildcard DNS makes every random name answer, so a naive brute-force fills with junk. puredns strips wildcard hits and poisoned answers so survivors are names that resolve for real.
Bruteforce mode takes a domain and a wordlist. Resolve mode takes an existing name list and confirms which answer. Use a public --resolvers pool for throughput, --resolvers-trusted to re-check survivors, and --rate-limit when the pool fights back. Raise --wildcard-tests when load-balanced DNS hides the catch-all. Trickest publishes both lists in the trickest/resolvers repo, the source the puredns README points to: resolvers.txt for the public pool and resolvers-trusted.txt for re-validation.
In a Trickest workflow, feed names from subfinder or a wordlist into the puredns node. It writes a file and a folder of clean resolved subdomains for httpx and later stages. Schedule the run to re-resolve the surface so dead names drop and new ones show up.
source github.com/d3mondev/puredns
use cases
Where puredns fits
Brute-force subdomains accurately
Run bruteforce mode with a wordlist against a domain and let wildcard filtering strip the false positives so only real subdomains survive.
Resolve a list of candidate names
Feed subdomains gathered from passive sources into resolve mode to confirm which actually resolve before spending probe time on them.
Validate against trusted resolvers
Use a public resolver pool for throughput and a trusted set for validation so DNS poisoning and load balancing do not corrupt the results.
reference
puredns inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Operating mode: bruteforce or resolve. |
| domain | STRING | · | Domain to brute-force (bruteforce mode only). |
| wordlist | FILE | · | Wordlist for bruteforce mode, or the list of names to resolve. |
| resolvers | FILE | --resolvers | File of public resolvers to query for throughput. |
| resolvers-trusted | FILE | --resolvers-trusted | File of trusted resolvers used to validate hits. |
| rate-limit | STRING | --rate-limit | Queries-per-second cap for public resolvers (0 = unlimited). |
| wildcard-tests | STRING | --wildcard-tests | Probes run to detect DNS load balancing (default 3). |
| skip-wildcard-filter | BOOLEAN | --skip-wildcard-filter | Turn off wildcard detection and filtering. |
Showing key inputs. puredns exposes 16 inputs in total.
Full flag reference (16 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Available modes: bruteforce, resolve |
| quiet | BOOLEAN | --quiet | quiet mode |
| domain | STRING | · | Domain name (available in 'bruteforce' mode only) |
| domains | FILE | --domains | text file containing domains to bruteforce |
| threads | STRING | --threads | number of threads to use while filtering wildcards (default 100) |
| wordlist | FILE | · | Wordlist used for bruteforcing in 'bruteforce' mode or list of domains in 'resolve' mode |
| resolvers | FILE | --resolvers | text file containing public resolvers |
| rate-limit | STRING | --rate-limit | limit total queries per second for public resolvers (0 = unlimited) (default unlimited) |
| trusted-only | BOOLEAN | --trusted-only | use only trusted resolvers (implies --skip-validation) |
| skip-sanitize | BOOLEAN | --skip-sanitize | do not sanitize the list of domains to test |
| wildcard-batch | STRING | --wildcard-batch | number of subdomains to test for wildcards in a single batch (0 = unlimited) (default unlimited) |
| wildcard-tests | STRING | --wildcard-tests | number of tests to perform to detect DNS load balancing (default 3) |
| skip-validation | BOOLEAN | --skip-validation | do not validate results with trusted resolvers |
| resolvers-trusted | FILE | --resolvers-trusted | text file containing trusted resolvers |
| rate-limit-trusted | STRING | --rate-limit-trusted | limit total queries per second for trusted resolvers (0 = unlimited) (default 500) |
| skip-wildcard-filter | BOOLEAN | --skip-wildcard-filter | do not perform wildcard detection and filtering |
example
Run puredns
# resolver lists from github.com/trickest/resolvers
curl -sO https://raw.githubusercontent.com/trickest/resolvers/main/resolvers.txt
curl -sO https://raw.githubusercontent.com/trickest/resolvers/main/resolvers-trusted.txt
# brute-force example.com against a wordlist, wildcards filtered out
puredns bruteforce wordlist.txt example.com \
--resolvers resolvers.txt --resolvers-trusted resolvers-trusted.txt \
--wildcard-tests 5 --rate-limit 1500www.example.com
api.example.com
mail.example.com
dev.example.com
staging.example.com
vpn.example.com
blog.example.com
admin.example.com
cdn.example.comguidance
Choosing puredns
Reach for puredns when you need high-volume subdomain resolution or bruteforce with wildcards filtered out. It wraps massdns and adds trusted validation so poisoned or catch-all answers do not pollute the list. Pair it with subfinder for discovery, then httpx to see what speaks HTTP.
massdns
Raw high-speed stub resolver. puredns wraps it and adds wildcard detection plus trusted validation.
shuffledns
Another massdns wrapper with a different wildcard algorithm. Peer drop-in when you want speed over puredns's trusted re-check pass.
subfinder
Passive subdomain discovery. Feed its output into puredns resolve mode before probing.
faq
puredns questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run puredns yourself
A domain and a wordlist feed puredns, which brute-forces and resolves names, filters out wildcards, and writes the clean resolved subdomains as output.
Facts on this page come from the live Trickest tool library.