What are the two output classes?

Root class: `level-1-wordlist` (tokens and dotted combinations) consumed by root-domain DNS brute force. Recursive class: `level-2-wordlist`, `level-3-wordlist`, `level-4-wordlist` consumed by recursive DNS brute force. Different consumers, different lists.

After a first hostname set exists (OSINT, root-domain brute force, or crawl), before a second brute-force pass. Skip it when you only have apex names or when the built-in lists cover the target.

How does it differ from DNS permutations?

Permutations alter FQDNs on the seed and resolve them. This emits wordlists for the brute-force modules to consume. Same seed, different role: one resolves, one derives.

Does it invent hyphen splits or number mutations?

No. The published examples are dotted labels and combinations already present in the input. Do not expect mutations the face does not make.

Can I feed apex domains as the seed?

No. This derives from known hostnames that already have labels, not from apex or root domains. Feed the output of a hostname enumerator (OSINT, root-domain brute force, or crawl). Apex-only input yields thin lists; the module has no labels to derive from.

2026-08-13

Attack Surface Management

Generate Custom DNS Wordlists

Derive DNS brute-force wordlists from known hostnames. Root-class and recursive level lists for the hostname enum modules. Does not resolve names.

What Generate Custom DNS Wordlists does

DNS wordlist generation turns the hostnames you already know into the wordlists the next brute-force pass needs. Subdomain enumeration plateaus when a generic list stops matching the target's naming conventions; this module derives org-specific lists from the keywords and dotted labels already in your seed, so a second pass hits names a public list would miss. It does not resolve names, does not enumerate, and is not a sixth hostname enumerator. You nest it between a seed set and a second brute-force pass; you do not run it from a shell.

You feed known hostnames. The module derives org-specific DNS wordlists from the keywords and naming already in those names. It does not resolve, does not enumerate, and is not a sixth hostname enumerator. You nest this feeder between a seed set and a second brute-force pass; you do not run it from a shell.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Known hostnames from any of the five enumerators.

Downstream

level-1-wordlist into Enumerate Hostnames via Root Domain DNS Brute Force as wordlist. level-2-wordlist, level-3-wordlist, and level-4-wordlist into Enumerate Hostnames via Recursive DNS Brute Force.

Parallel

DNS permutations on the same seed. That alters FQDNs and resolves them. This emits lists and resolves nothing.

When to use this

Nest this after a seed hostname set exists, before a second brute-force pass. Skip it when you only have apex names or when the built-in lists are enough. Any of the five hostname enumerators can produce the seed: Enumerate Hostnames via OSINT Sources, Enumerate Hostnames via Crawling, Enumerate Hostnames via DNS Permutations Brute Force, Enumerate Hostnames via Root Domain DNS Brute Force, and Enumerate Hostnames via Recursive DNS Brute Force.

Data

The tables this module produces. Sample rows are illustrative.

level-1-wordlist1 column · 3 sample rows

Root-class wordlist: tokens and dotted combinations from the input hostnames. Consumed by root-domain DNS brute force.

	wordtext
1	api
2	staging
3	dev

level-2-wordlist1 column · 3 sample rows

Recursive-class wordlist for second-level subdomain brute force.

	wordtext
1	internal
2	portal
3	vpn

level-3-wordlist1 column · 3 sample rows

Recursive-class wordlist for third-level subdomain brute force.

	wordtext
1	auth
2	cache
3	proxy

level-4-wordlist1 column · 3 sample rows

Recursive-class wordlist for fourth-level subdomain brute force.

	wordtext
1	edge
2	node
3	relay

questions

Generate Custom DNS Wordlists questions

No. It derives wordlists from hostnames you already have. It does not resolve names and does not produce a hostname list. The five enumerators consume its output, or produce the seed it reads.

Related modules

Nest Generate Custom DNS Wordlists in a workflow

Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.

Build with Generate Custom DNS Wordlists Browse modules

Get a personalized demo

See Trickest in Action

A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.

Book a demo Explore the platform