Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Network

Keep only DNS resolvers that match baselines

Validate public DNS resolvers against trusted baselines.

Agent
Produce a trusted resolver listCut false positives in DNS brute forcingKeep the resolver set fresh

overview

What dnsvalidator does

dnsvalidator takes a list of public DNS servers (-tL) and tests each against trusted baselines. Only servers that return accurate, untampered answers stay on the list.

This is plumbing for the rest of a DNS pipeline. massdns, shuffledns, and puredns are only as reliable as their resolver file. One hijacking or ad-injecting resolver corrupts every brute-force run that touches it.

Run it before any high-volume resolution stage, and refresh on a schedule. -threads and -timeout tune large pools; -e and -eL drop known-bad ranges before validation spends cycles on them.

source github.com/vortexau/dnsvalidator

use cases

Where dnsvalidator fits

Produce a trusted resolver list

Validate a large pool of public DNS servers against baselines with -tL and keep only the servers that answer accurately, ready for downstream resolution.

Cut false positives in DNS brute forcing

Feed the validated list into massdns, shuffledns, or puredns so hijacking or lying resolvers do not inflate your subdomain results with names that do not exist.

Keep the resolver set fresh

Re-run dnsvalidator on a schedule so the list stays current as public servers appear, disappear, or start returning bad answers.

Drop known-bad ranges before a run

Use -e and -eL to exclude resolvers or ranges you already distrust so the validation pass spends its threads on candidates worth checking.

reference

dnsvalidator inputs and flags

10 inputs
NameTypeFlagDescription
targets-listFILE-tLList of DNS servers, or a URL to a list, to verify.
targetSTRING-tA single DNS server to verify.
exclusions-listFILE-eLList of targets to exclude from verification.
root-domain-compareSTRING-rRoot domain to compare against; use a non-geolocated one.
resolver-querySTRING-qResolver query to use (default dnsvalidator).
threadsSTRING-threadsMaximum concurrent threads (default 5).
timeoutSTRING-timeoutTimeout in seconds per thread (default 600).
silentBOOLEAN--silentShow only successfully resolved servers, redacting banners.

Showing key inputs. dnsvalidator exposes 10 inputs in total.

Full flag reference (10 inputs)
NameTypeFlagDescription
silentBOOLEAN--silentShow only successfully resolved servers and redact banners and other information.
targetSTRING-tSpecify a single DNS server to verify.
threadsSTRING-threadsMaximum number of threads to run at any one time (default 5).
timeoutSTRING-timeoutTimeout value in seconds for any single thread (default 600).
no-colorBOOLEAN--no-colorStrip any foreground or background colours from output.
exclusionSTRING-eSpecify a single target to exclude from verification.
targets-listFILE-tLSpecify a list of targets, or a URL to a list of targets, to verify.
resolver-querySTRING-qResolver query to use (default dnsvalidator).
exclusions-listFILE-eLSpecify a list of targets, or a URL to a list, to exclude from verification.
root-domain-compareSTRING-rRoot domain to compare against. Must be non-geolocated or most resolvers will fail.

example

Run dnsvalidator

dnsvalidator · command
# validate candidate resolvers against a baseline and keep the clean setdnsvalidator -tL nameservers.txt -threads 20 -timeout 30 -o resolvers.txt
sample output
[*] Started with 1656 servers to be validated203.0.113.5203.0.113.61198.51.100.14203.0.113.128198.51.100.72203.0.113.9198.51.100.201[*] Finished. 47 valid resolvers written to resolvers.txt

guidance

Choosing dnsvalidator

Use dnsvalidator to build a trustworthy resolver list before any mass DNS resolution. It does not discover or resolve subdomains itself; it curates the resolvers those tools depend on. Run it ahead of massdns, shuffledns, or puredns.

shuffledns

Resolves and brute-forces subdomains with massdns. dnsvalidator supplies the clean resolver list it relies on.

puredns

Resolver with built-in wildcard filtering. dnsvalidator focuses solely on validating the resolver pool.

massdns

High-speed bulk resolver. Its accuracy depends on the validated resolvers dnsvalidator produces.

faq

dnsvalidator questions

It sends a query to each candidate resolver and compares the answer to trusted baseline servers. A server stays on the list only when its response matches the baseline, so resolvers that hijack, inject, or return stale records get dropped.

related

More Network tools

  1. asnmap

    Map an organization's network ranges from ASN data.

  2. fping

    Parallel ICMP echo sweeps for CIDR ranges and host files.

  3. httprobe

    Probe a domain list for working HTTP and HTTPS servers.

  4. httpx

    A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.

  5. mapcidr

    Expand, aggregate, and slice CIDR ranges into host lists.

  6. masscan

    Asynchronous SYN port scanner for wide IP ranges; bound runs with --rate and --excludefile.

Run dnsvalidator yourself

A raw resolver list feeds dnsvalidator, which keeps only accurate servers and hands the clean list to shuffledns for trustworthy resolution as output.

Open dnsvalidator in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.