Utilities
Permute known domains into DNS candidates
Wordlist and mined-word subdomain permutation.
overview
What dnsgen does
dnsgen reads a domains file and emits a larger candidate set by combining those seeds with --wordlist labels and custom words mined from the inputs (--wordlen sets the minimum mined length).
Use it after passive or active discovery has a seed list, when you want related names that sources never returned. It does not resolve; a false-looking name is still just a string until dnsx or shuffledns keeps the hits.
Compared with dmut, dnsgen stops at generation. As a managed Trickest node, wire its file or folder into shuffledns or dnsx, then probe survivors with httpx. Flip --fast when the seed list is huge and you can trade some patterns for speed.
use cases
Where dnsgen fits
Expand a known subdomain list
Generate permutations from discovered subdomains so a resolver can find related hosts that passive sources never returned.
Mine patterns from the inputs
Let dnsgen extract custom words from your domains and recombine them, capturing the naming conventions an organization uses.
Feed an active brute-force stage
Write candidates that a fast resolver validates, turning a permutation list into a clean set of live names for probing.
Speed up large permutation runs
Enable --fast when the input list is huge and you need candidates quickly before a mass DNS resolve.
reference
dnsgen inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | List of domains |
| custom-wordlist | FILE | --wordlist | Custom wordlist. |
| word-length | STRING | --wordlen | Min length of custom words extracted from domains. [1<=x<=100] |
| fast-generation | BOOLEAN | --fast | Fast generation |
Showing key inputs. dnsgen exposes 4 inputs in total.
example
Run dnsgen
# dnsgen: permute known hosts, mine short custom words, write candidatescat known-domains.txt | dnsgen - --wordlen 3 --wordlist words.txt > candidates.txtapi-dev.example.comdev-api.example.comstaging-api.example.comapi-staging.example.comwww-dev.example.comdev-www.example.commail-backup.example.combackup-mail.example.comvpn-test.example.comguidance
Choosing dnsgen
Use when you already have subdomains and need permutation candidates for a separate resolve step. Prefer dmut when generation and resolution must stay in one node. Prefer gotator when you want deeper rule-driven alterations instead of mined words plus a wordlist.
dmut
Generates and resolves in one run. dnsgen only generates.
gotator
Rule and depth driven permutations. dnsgen mines custom words from the seed domains.
goaltdns
Alteration-based generator. dnsgen leans on --wordlist plus extracted words.
faq
dnsgen questions
related
More Utilities tools
browser-fetch
Headless Chromium render: requested URL, final URL, status, and title next to the page.
cewl
Spider a URL and return a wordlist for password crackers.
csvkit
SQL on one CSV. The table name is the file stem.
duckdb
In-process SQL on CSV, JSON, and Parquet. No server.
edge-tts
Microsoft Edge neural speech from text or a script file. No API key.
exiftool
Read embedded metadata from hundreds of image, media, and document formats.
Run dnsgen yourself
A known-domains list feeds dnsgen, which generates permutations and hands them to dnsx, which resolves the candidates into live names as output.
Facts on this page come from the live Trickest tool library.