Network
Curate a trusted public resolver pool
Keep only IPv4 resolvers that match baseline answers.
overview
What dnsvalidator-patch does
Slot dnsvalidator-patch ahead of massdns, shuffledns, or puredns so every resolve stage consumes a vetted resolver list rather than a raw public dump.
When a brute force returns hosts that do not exist, rebuild the pool. Candidates arrive via -tL or -t; drop known-bad addresses with -eL or -e before verification.
Each candidate is checked against baselines for a known host and a name that should NXDOMAIN. Only servers whose positive answer and NXDOMAIN both match land in the FILE and FOLDER outputs.
use cases
Where dnsvalidator-patch fits
Curate resolvers for mass resolution
Validate a public DNS pool against baselines and emit only the accurate servers so massdns or puredns brute-forces from a list you trust.
Refresh the resolver pool on a schedule
Run the node on a schedule so the validated list keeps pace with public resolvers going offline or turning unreliable.
Keep known-bad servers out
Feed an exclusions list with -eL, or drop single addresses with -e, so resolvers you already distrust never re-enter the set.
Clear false positives from a poisoned resolver
When a brute force returns hosts that do not exist, rebuild the pool from validated servers to strip out the resolver that was injecting answers.
reference
dnsvalidator-patch inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| targets-list | FILE | -tL | List of DNS servers, or a URL to a list, to verify. |
| target | STRING | -t | A single DNS server to verify. |
| exclusions-list | FILE | -eL | List of targets to exclude from verification. |
| root-domain-compare | STRING | -r | Root domain to compare against; use a non-geolocated one. |
| resolver-query | STRING | -q | Resolver query to use (default dnsvalidator). |
| threads | STRING | -threads | Maximum concurrent threads (default 5). |
| timeout | STRING | -timeout | Timeout in seconds per thread (default 600). |
| silent | BOOLEAN | --silent | Show only successfully resolved servers, redacting banners. |
Showing key inputs. dnsvalidator-patch exposes 10 inputs in total.
Full flag reference (10 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| silent | BOOLEAN | --silent | If set then only successfully resolved servers will be displayed and banners and other information will be redacted. |
| target | STRING | -t | Specify a target DNS server to verify. |
| threads | STRING | -threads | Specify the maximum number of threads to run at any one time (default 5). |
| timeout | STRING | -timeout | Specify a timeout value in seconds for any single thread (default 600). |
| no-color | BOOLEAN | --no-color | If set then any foreground or background colours will be stripped out. |
| exclusion | STRING | -e | Specify a target exclusion. |
| targets-list | FILE | -tL | Specify a list of targets or a URL to a list of targets. |
| resolver-query | STRING | -q | Specify a resolver query to use (default dnsvalidator). |
| exclusions-list | FILE | -eL | Specify a list of targets or a URL to a list of targets to exclude. |
| root-domain-compare | STRING | -r | Specify a root domain to compare to. Must be non-geolocated or most resolvers will fail. |
example
Run dnsvalidator-patch
# verify public resolvers against baselines, keep only the accurate onesdnsvalidator -tL resolvers.txt -eL exclude.txt -threads 20[14:22:07] [INFO] [baseline] resolving baseline[14:22:07] [INFO] [198.51.100.10] Checking...[14:22:07] [ACCEPTED] [198.51.100.10] provided valid response[14:22:08] [ACCEPTED] [198.51.100.23] provided valid response[14:22:08] [REJECTED] [203.0.113.44] invalid response received[14:22:09] [ACCEPTED] [198.51.100.61] provided valid response[14:22:09] [REJECTED] [203.0.113.90] invalid response received[14:22:15] [INFO] Finished. Discovered 3 serversguidance
Choosing dnsvalidator-patch
Use dnsvalidator-patch when you need a validated resolver list and prefer the maintained build for in-workflow runs. It curates resolvers; it does not resolve subdomains. Run it before massdns, shuffledns, or puredns. For the upstream build, use dnsvalidator.
dnsvalidator
Upstream build. This patched version targets reliable execution inside Trickest workflows.
shuffledns
Resolves and brute-forces subdomains. dnsvalidator-patch supplies the trusted resolver list it consumes.
puredns
Resolver with wildcard filtering. dnsvalidator-patch only validates the resolver pool.
faq
dnsvalidator-patch questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run dnsvalidator-patch yourself
A raw resolver list feeds dnsvalidator-patch, which keeps only accurate servers and hands the clean list to massdns for trustworthy resolution as output.
Facts on this page come from the live Trickest tool library.