loading
Loading content
loading
Network
Keep only IPv4 resolvers that match baseline answers.
overview
Slot dnsvalidator-patch ahead of massdns, shuffledns, or puredns so every resolve stage consumes a vetted resolver list rather than a raw public dump.
When a brute force returns hosts that do not exist, rebuild the pool. Candidates arrive via -tL or -t; drop known-bad addresses with -eL or -e before verification.
Each candidate is checked against baselines for a known host and a name that should NXDOMAIN. Only servers whose positive answer and NXDOMAIN both match land in the FILE and FOLDER outputs.
use cases
Validate a public DNS pool against baselines and emit only the accurate servers so massdns or puredns brute-forces from a list you trust.
Run the node on a schedule so the validated list keeps pace with public resolvers going offline or turning unreliable.
Feed an exclusions list with -eL, or drop single addresses with -e, so resolvers you already distrust never re-enter the set.
When a brute force returns hosts that do not exist, rebuild the pool from validated servers to strip out the resolver that was injecting answers.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets-list | FILE | -tL | List of DNS servers, or a URL to a list, to verify. |
| target | STRING | -t | A single DNS server to verify. |
| exclusions-list | FILE | -eL | List of targets to exclude from verification. |
| root-domain-compare | STRING | -r | Root domain to compare against; use a non-geolocated one. |
| resolver-query | STRING | -q | Resolver query to use (default dnsvalidator). |
| threads | STRING | -threads | Maximum concurrent threads (default 5). |
| timeout | STRING | -timeout | Timeout in seconds per thread (default 600). |
| silent | BOOLEAN | --silent | Show only successfully resolved servers, redacting banners. |
Showing key inputs. dnsvalidator-patch exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| silent | BOOLEAN | --silent | If set then only successfully resolved servers will be displayed and banners and other information will be redacted. |
| target | STRING | -t | Specify a target DNS server to verify. |
| threads | STRING | -threads | Specify the maximum number of threads to run at any one time (default 5). |
| timeout | STRING | -timeout | Specify a timeout value in seconds for any single thread (default 600). |
| no-color | BOOLEAN | --no-color | If set then any foreground or background colours will be stripped out. |
| exclusion | STRING | -e | Specify a target exclusion. |
| targets-list | FILE | -tL | Specify a list of targets or a URL to a list of targets. |
| resolver-query | STRING | -q | Specify a resolver query to use (default dnsvalidator). |
| exclusions-list | FILE | -eL | Specify a list of targets or a URL to a list of targets to exclude. |
| root-domain-compare | STRING | -r | Specify a root domain to compare to. Must be non-geolocated or most resolvers will fail. |
example
# verify public resolvers against baselines, keep only the accurate onesdnsvalidator -tL resolvers.txt -eL exclude.txt -threads 20[14:22:07] [INFO] [baseline] resolving baseline[14:22:07] [INFO] [198.51.100.10] Checking...[14:22:07] [ACCEPTED] [198.51.100.10] provided valid response[14:22:08] [ACCEPTED] [198.51.100.23] provided valid response[14:22:08] [REJECTED] [203.0.113.44] invalid response received[14:22:09] [ACCEPTED] [198.51.100.61] provided valid response[14:22:09] [REJECTED] [203.0.113.90] invalid response received[14:22:15] [INFO] Finished. Discovered 3 serversguidance
Use dnsvalidator-patch when you need a validated resolver list and prefer the maintained build for in-workflow runs. It curates resolvers; it does not resolve subdomains. Run it before massdns, shuffledns, or puredns. For the upstream build, use dnsvalidator.
Upstream build. This patched version targets reliable execution inside Trickest workflows.
Resolves and brute-forces subdomains. dnsvalidator-patch supplies the trusted resolver list it consumes.
Resolver with wildcard filtering. dnsvalidator-patch only validates the resolver pool.
faq
related
Map an organization's network ranges from ASN data.
Validate public DNS resolvers against trusted baselines.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
A raw resolver list feeds dnsvalidator-patch, which keeps only accurate servers and hands the clean list to massdns for trustworthy resolution as output.
Facts on this page come from the live Trickest tool library.