Enumerate Hostnames via Root Domain DNS Brute Force

DNS brute force against the apex is how you find unpublished first-level subdomains. Given a list of root domains, the module resolves first-level hostname candidates (label.example.com) against a wordlist to surface names that passive OSINT never recorded, then feeds those names into permutations and recursive brute force for deeper coverage. A built-in wordlist runs by default; pin a custom one when you know the target's naming conventions.

You feed apex domains. The module wordlists first-level names against those apexes (label.example.com) and resolves them. A built-in list runs unless you pin a custom wordlist. This is first-level vs the apex, not sub-subdomains of names you already have. You nest this subgraph on a domain list; you do not run it from a shell.