Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

OSINT

Pull a domain DNS footprint without probing it

Passive DNS records from DNSDumpster.

Agent
Seed an attack-surface map passivelyDiscover infrastructure for an asset inventoryMap a domain's mail and name-server setup

overview

What dnsdumpster-dns-lookup does

Feed a root domain; the node queries DNSDumpster and writes host (A) records with IPs, name servers, mail servers, and TXT data to a file and folder for downstream steps.

Reach for it at the start of recon when you want a quiet DNS map before any active resolution or HTTP probing. Nothing is sent to the target's name servers.

Compared with dnsx or dnsrecon, this stays passive. Use dnsdumpster-host-search for a host-centric query on the same service. Pass returned hostnames to httpx or dnsx to verify what is live.

use cases

Where dnsdumpster-dns-lookup fits

Seed an attack-surface map passively

Pull a domain's hosts, name servers, and mail records from DNSDumpster to scope an engagement without sending traffic to the target.

Discover infrastructure for an asset inventory

Capture the DNS records tied to a root domain as a starting inventory the rest of the workflow expands and verifies.

Map a domain's mail and name-server setup

Read the MX, NS, and TXT records to see how a domain routes mail and delegates DNS before you probe any host.

Feed probing and resolution stages

Hand the returned hostnames to httpx or dnsx so the workflow continues from a passively gathered seed set.

reference

dnsdumpster-dns-lookup inputs and flags

1 inputs
NameTypeFlagDescription
domainSTRING·Root domain to enumerate (passed as the node's single input).

Showing key inputs. dnsdumpster-dns-lookup exposes 1 inputs in total.

example

Run dnsdumpster-dns-lookup

dnsdumpster-dns-lookup · command
# passive DNS records for a domain via DNSDumpsterdnsdumpster-dns-lookup example.com
sample output
Host Records (A)example.com        203.0.113.10   HTTP: nginx   AS64500 Example Cloudwww.example.com    203.0.113.11   HTTP: nginx   AS64500 Example Cloudmail.example.com   203.0.113.25   SMTP          AS64500 Example CloudDNS Serversns1.example.com    198.51.100.53  AS64500 Example Cloudns2.example.com    198.51.100.54  AS64500 Example CloudMX Records10 mail.example.comTXT: v=spf1 include:_spf.example.com ~all

guidance

Choosing dnsdumpster-dns-lookup

Use DNSDumpster DNS Lookup at the start of recon when you want DNS records for a domain without querying it directly. For a host-centric search on the same service, use dnsdumpster-host-search. To actively resolve records yourself, use dnsx or dnsrecon.

dnsdumpster-host-search

Host-focused search on the same service. This node returns the domain's DNS records instead.

dnsx

Actively resolves DNS records against your own resolvers. DNSDumpster Lookup is passive.

dnsrecon

Active multi-technique DNS enumeration. Use it when you want to query the domain directly.

faq

dnsdumpster-dns-lookup questions

The node's only input is the domain, so you do not wire an API key into the workflow. DNSDumpster.com itself now offers an API that needs a free key if you query the service directly outside Trickest.

related

More OSINT tools

  1. dnstwist

    Generate lookalike domains and flag registered typosquats.

  2. favup

    Look up the real IP of a host from its favicon via Shodan.

  3. Infoga

    Email OSINT from public sources, with optional breach checks.

  4. maigret

    Username search that collects accounts and profile data into one dossier.

  5. socialscan

    Check whether emails and usernames are available, taken, or invalid.

  6. dnsdumpster-host-search

    Passive DNSDumpster host lookup by domain.

Run dnsdumpster-dns-lookup yourself

A domain feeds DNSDumpster DNS Lookup, which returns its DNS records passively and passes the hosts to httpx before they land as output.

Open dnsdumpster-dns-lookup in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.