What does --wordlen control?

Minimum length of custom words mined from the input domains before those words recombine with the wordlist and seeds.

When should I enable --fast?

On very large seed lists when you want candidates quickly and can accept a narrower permutation set.

How does --wordlist change the output?

It supplies labels combined with the input domains. Without it, dnsgen still mines words from the domains themselves.

How does dnsgen differ from dmut?

dmut generates and resolves in one pass. dnsgen only writes candidates, so you choose the resolver and keep the graph composable.

Updated Jul 15, 2026

Utilities

Permute known domains into DNS candidates

Q: Does dnsgen resolve the names it creates?

No. Pass output to shuffledns or dnsx and keep only names that exist.

Wordlist and mined-word subdomain permutation.

Expand a known subdomain list Mine patterns from the inputs Feed an active brute-force stage

overview

What dnsgen does

dnsgen reads a domains file and emits a larger candidate set by combining those seeds with --wordlist labels and custom words mined from the inputs (--wordlen sets the minimum mined length).

Use it after passive or active discovery has a seed list, when you want related names that sources never returned. It does not resolve; a false-looking name is still just a string until dnsx or shuffledns keeps the hits.

Compared with dmut, dnsgen stops at generation. As a managed Trickest node, wire its file or folder into shuffledns or dnsx, then probe survivors with httpx. Flip --fast when the seed list is huge and you can trade some patterns for speed.

source github.com/ProjectAnte/dnsgen

use cases

Where dnsgen fits

Expand a known subdomain list

Generate permutations from discovered subdomains so a resolver can find related hosts that passive sources never returned.

Mine patterns from the inputs

Let dnsgen extract custom words from your domains and recombine them, capturing the naming conventions an organization uses.

Feed an active brute-force stage

Write candidates that a fast resolver validates, turning a permutation list into a clean set of live names for probing.

Speed up large permutation runs

Enable --fast when the input list is huge and you need candidates quickly before a mass DNS resolve.

reference

dnsgen inputs and flags

4 inputs

Name	Type	Flag	Description
domains	FILE	·	List of domains
custom-wordlist	FILE	--wordlist	Custom wordlist.
word-length	STRING	--wordlen	Min length of custom words extracted from domains. [1<=x<=100]
fast-generation	BOOLEAN	--fast	Fast generation

Showing key inputs. dnsgen exposes 4 inputs in total.

example

Run dnsgen

dnsgen · command

# dnsgen: permute known hosts, mine short custom words, write candidatescat known-domains.txt | dnsgen - --wordlen 3 --wordlist words.txt > candidates.txt

sample output

api-dev.example.comdev-api.example.comstaging-api.example.comapi-staging.example.comwww-dev.example.comdev-www.example.commail-backup.example.combackup-mail.example.comvpn-test.example.com

guidance

Choosing dnsgen

Use when you already have subdomains and need permutation candidates for a separate resolve step. Prefer dmut when generation and resolution must stay in one node. Prefer gotator when you want deeper rule-driven alterations instead of mined words plus a wordlist.

dmut

Generates and resolves in one run. dnsgen only generates.

gotator

Rule and depth driven permutations. dnsgen mines custom words from the seed domains.

goaltdns

Alteration-based generator. dnsgen leans on --wordlist plus extracted words.

faq

dnsgen questions

No. Pass output to shuffledns or dnsx and keep only names that exist.

Run dnsgen yourself

A known-domains list feeds dnsgen, which generates permutations and hands them to dnsx, which resolves the candidates into live names as output.

Open dnsgen in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.