loading
Loading content
loading
Network
Patched dnsvalidator that keeps only IPv4 resolvers verified against baseline servers.
overview
dnsvalidator-patch is a maintained build of dnsvalidator that vets a list of public DNS servers and keeps only the ones that answer like a trustworthy resolver. Each candidate is queried against baseline servers for both a known host and a name that should not exist, so a resolver passes only when its positive answer and its NXDOMAIN both line up with the baselines.
That check catches a quiet but expensive problem in DNS recon: a resolver that hijacks NXDOMAIN or injects answers turns a clean brute force into a pile of false positives. Curating a verified pool first means every downstream resolution stage works from servers you can trust.
On Trickest, dnsvalidator-patch is a Network node that takes a target or a targets list and writes a file and a folder of validated resolvers. Slot it ahead of massdns, shuffledns, or puredns, and refresh it on a schedule so the pool keeps pace with the public resolver landscape.
use cases
Validate a public DNS pool against baselines and emit only the accurate servers so massdns or puredns brute-forces from a list you trust.
Run the node on a schedule so the validated list keeps pace with public resolvers going offline or turning unreliable.
Feed an exclusions list with -eL, or drop single addresses with -e, so resolvers you already distrust never re-enter the set.
When a brute force returns hosts that do not exist, rebuild the pool from validated servers to strip out the resolver that was injecting answers.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets-list | FILE | -tL | List of DNS servers, or a URL to a list, to verify. |
| target | STRING | -t | A single DNS server to verify. |
| exclusions-list | FILE | -eL | List of targets to exclude from verification. |
| root-domain-compare | STRING | -r | Root domain to compare against; use a non-geolocated one. |
| resolver-query | STRING | -q | Resolver query to use (default dnsvalidator). |
| threads | STRING | -threads | Maximum concurrent threads (default 5). |
| timeout | STRING | -timeout | Timeout in seconds per thread (default 600). |
| silent | BOOLEAN | --silent | Show only successfully resolved servers, redacting banners. |
Showing key inputs. dnsvalidator-patch exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| silent | BOOLEAN | --silent | If set then only successfully resolved servers will be displayed and banners and other information will be redacted. |
| target | STRING | -t | Specify a target DNS server to verify. |
| threads | STRING | -threads | Specify the maximum number of threads to run at any one time (default 5). |
| timeout | STRING | -timeout | Specify a timeout value in seconds for any single thread (default 600). |
| no-color | BOOLEAN | --no-color | If set then any foreground or background colours will be stripped out. |
| exclusion | STRING | -e | Specify a target exclusion. |
| targets-list | FILE | -tL | Specify a list of targets or a URL to a list of targets. |
| resolver-query | STRING | -q | Specify a resolver query to use (default dnsvalidator). |
| exclusions-list | FILE | -eL | Specify a list of targets or a URL to a list of targets to exclude. |
| root-domain-compare | STRING | -r | Specify a root domain to compare to. Must be non-geolocated or most resolvers will fail. |
example
# verify public resolvers against baselines, keep only the accurate onesdnsvalidator -tL resolvers.txt -eL exclude.txt -threads 20[14:22:07] [INFO] [baseline] resolving baseline[14:22:07] [INFO] [198.51.100.10] Checking...[14:22:07] [ACCEPTED] [198.51.100.10] provided valid response[14:22:08] [ACCEPTED] [198.51.100.23] provided valid response[14:22:08] [REJECTED] [203.0.113.44] invalid response received[14:22:09] [ACCEPTED] [198.51.100.61] provided valid response[14:22:09] [REJECTED] [203.0.113.90] invalid response received[14:22:15] [INFO] Finished. Discovered 3 serversguidance
Use dnsvalidator-patch when you want a validated resolver list and prefer the maintained build for in-workflow reliability. It curates resolvers, it does not resolve subdomains. Run it before massdns, shuffledns, or puredns. If you specifically need the upstream build, use dnsvalidator.
The upstream build. This patched version targets reliable execution inside Trickest workflows.
Resolves and brute-forces subdomains. dnsvalidator-patch supplies the trusted resolver list it consumes.
Resolver with wildcard filtering. dnsvalidator-patch focuses on validating the resolver pool only.
faq
related
Quickly map an organization's network ranges using ASN information.
Maximize your resolver count by combining the target's DNS servers with public resolvers.
Expand CIDR ranges into a list of IP addresses easily.
Expand CIDR ranges into a list of IP addresses easily, from a file.
Maintain a list of IPv4 DNS servers verified against baseline servers for accurate responses.
A simple Node.js network scanner.
A raw resolver list feeds dnsvalidator-patch, which keeps only accurate servers and hands the clean list to massdns for trustworthy resolution as output.
Facts on this page come from the live Trickest tool library.