loading
Loading content
loading
Network
Validate public DNS resolvers against trusted baselines.
overview
dnsvalidator takes a list of public DNS servers (-tL) and tests each against trusted baselines. Only servers that return accurate, untampered answers stay on the list.
This is plumbing for the rest of a DNS pipeline. massdns, shuffledns, and puredns are only as reliable as their resolver file. One hijacking or ad-injecting resolver corrupts every brute-force run that touches it.
Run it before any high-volume resolution stage, and refresh on a schedule. -threads and -timeout tune large pools; -e and -eL drop known-bad ranges before validation spends cycles on them.
use cases
Validate a large pool of public DNS servers against baselines with -tL and keep only the servers that answer accurately, ready for downstream resolution.
Feed the validated list into massdns, shuffledns, or puredns so hijacking or lying resolvers do not inflate your subdomain results with names that do not exist.
Re-run dnsvalidator on a schedule so the list stays current as public servers appear, disappear, or start returning bad answers.
Use -e and -eL to exclude resolvers or ranges you already distrust so the validation pass spends its threads on candidates worth checking.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets-list | FILE | -tL | List of DNS servers, or a URL to a list, to verify. |
| target | STRING | -t | A single DNS server to verify. |
| exclusions-list | FILE | -eL | List of targets to exclude from verification. |
| root-domain-compare | STRING | -r | Root domain to compare against; use a non-geolocated one. |
| resolver-query | STRING | -q | Resolver query to use (default dnsvalidator). |
| threads | STRING | -threads | Maximum concurrent threads (default 5). |
| timeout | STRING | -timeout | Timeout in seconds per thread (default 600). |
| silent | BOOLEAN | --silent | Show only successfully resolved servers, redacting banners. |
Showing key inputs. dnsvalidator exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| silent | BOOLEAN | --silent | Show only successfully resolved servers and redact banners and other information. |
| target | STRING | -t | Specify a single DNS server to verify. |
| threads | STRING | -threads | Maximum number of threads to run at any one time (default 5). |
| timeout | STRING | -timeout | Timeout value in seconds for any single thread (default 600). |
| no-color | BOOLEAN | --no-color | Strip any foreground or background colours from output. |
| exclusion | STRING | -e | Specify a single target to exclude from verification. |
| targets-list | FILE | -tL | Specify a list of targets, or a URL to a list of targets, to verify. |
| resolver-query | STRING | -q | Resolver query to use (default dnsvalidator). |
| exclusions-list | FILE | -eL | Specify a list of targets, or a URL to a list, to exclude from verification. |
| root-domain-compare | STRING | -r | Root domain to compare against. Must be non-geolocated or most resolvers will fail. |
example
# validate candidate resolvers against a baseline and keep the clean setdnsvalidator -tL nameservers.txt -threads 20 -timeout 30 -o resolvers.txt[*] Started with 1656 servers to be validated203.0.113.5203.0.113.61198.51.100.14203.0.113.128198.51.100.72203.0.113.9198.51.100.201[*] Finished. 47 valid resolvers written to resolvers.txtguidance
Use dnsvalidator to build a trustworthy resolver list before any mass DNS resolution. It does not discover or resolve subdomains itself; it curates the resolvers those tools depend on. Run it ahead of massdns, shuffledns, or puredns.
Resolves and brute-forces subdomains with massdns. dnsvalidator supplies the clean resolver list it relies on.
Resolver with built-in wildcard filtering. dnsvalidator focuses solely on validating the resolver pool.
High-speed bulk resolver. Its accuracy depends on the validated resolvers dnsvalidator produces.
faq
related
Map an organization's network ranges from ASN data.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
Asynchronous SYN port scanner for wide IP ranges; bound runs with --rate and --excludefile.
A raw resolver list feeds dnsvalidator, which keeps only accurate servers and hands the clean list to shuffledns for trustworthy resolution as output.
Facts on this page come from the live Trickest tool library.