loading
Loading content
loading
Recon
A fast, multi-purpose DNS toolkit that runs multiple probers with custom resolvers.
overview
dnsx resolves a list of subdomains or hosts at high speed against resolvers you supply, reporting which names are live and what they point to. Pass -resp and it prints each host next to its DNS response; pass -resp-only and it prints just the response value without the host, which is why those two flags carry most of its everyday use.
It queries any record type you name — A (-a, the default), AAAA, CNAME (-cname), MX, NS, TXT, SRV, PTR, SOA, and CAA — or pulls them all in one pass with -recon. Layered on top are enrichment and filtering: -asn and -cdn annotate each result with network and CDN data, -rcode keeps only chosen DNS status codes, and -wildcard-domain strips wildcard noise so only real hosts survive.
dnsx also doubles as a brute-forcer: give it -domain and -wordlist and it generates candidates and resolves them in a single run. In a Trickest workflow, feed it a hosts or domains list and it writes a file and a folder of results, adding -json for structured JSONL downstream. Run it after subdomain discovery to resolve and dedupe, then hand the live hosts to httpx.
use cases
Run a passive finder's output through dnsx with your own resolvers to keep only names that resolve, deduplicated and ready for probing.
Feed a domain and a wordlist so dnsx generates candidates and resolves them in one pass, with wildcard filtering to drop noise.
Query MX, NS, TXT, or CNAME across a host list, or use recon mode for everything, emitting JSONL for downstream analysis.
Add ASN and CDN annotations during resolution so later stages can route or scope by network and infrastructure provider.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| list | FILE | -list | List of subdomains or hosts to resolve (file or stdin). |
| resp | BOOLEAN | -resp | Display each host alongside its DNS response. |
| resp-only | BOOLEAN | -resp-only | Display only the DNS response value, without the host. |
| a | BOOLEAN | -a | Query the A record (the default query type). |
| cname | BOOLEAN | -cname | Query the CNAME record. |
| recon | BOOLEAN | -recon | Query every DNS record type in one pass. |
| resolver | STRING | -resolver | Resolvers to use, comma-separated. |
| json | BOOLEAN | -json | Write output in JSONL format. |
Showing key inputs. dnsx exposes 40 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| a | BOOLEAN | -a | query A record (default) |
| mx | BOOLEAN | -mx | query MX record |
| ns | BOOLEAN | -ns | query NS record |
| any | BOOLEAN | -any | query ANY record |
| asn | BOOLEAN | -asn | display host asn information |
| caa | BOOLEAN | -caa | query CAA record |
| cdn | BOOLEAN | -cdn | display cdn name |
| ptr | BOOLEAN | -ptr | query PTR record |
| soa | BOOLEAN | -soa | query SOA record |
| srv | BOOLEAN | -srv | query SRV record |
| txt | BOOLEAN | -txt | query TXT record |
| aaaa | BOOLEAN | -aaaa | query AAAA record |
| axfr | BOOLEAN | -axfr | query AXFR |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| list | FILE | -list | list of sub(domains)/hosts to resolve (file or stdin) |
| resp | BOOLEAN | -resp | display dns response |
| cname | BOOLEAN | -cname | query CNAME record |
| debug | BOOLEAN | -debug | display raw dns response |
| rcode | STRING | -rcode | filter result by dns status code (eg. -rcode noerror,servfail,refused) |
| recon | BOOLEAN | -recon | query all the dns records (a,aaaa,cname,ns,txt,srv,ptr,mx,soa,axfr,caa) |
| retry | STRING | -retry | number of dns attempts to make (must be at least 1) (default 2) |
| stats | BOOLEAN | -stats | display stats of the running scan |
| trace | BOOLEAN | -trace | perform dns tracing |
| domain | FILE | -domain | list of domain to bruteforce (file or comma separated or stdin) |
| silent | BOOLEAN | -silent | display only results in the output |
| threads | STRING | -threads | number of concurrent threads to use (default 100) |
| verbose | BOOLEAN | -verbose | display verbose output |
| no-color | BOOLEAN | -no-color | disable color in output |
| omit-raw | BOOLEAN | -omit-raw | omit raw dns response from jsonl output |
| resolver | STRING | -resolver | list of resolvers to use (comma separated) |
| wordlist | FILE | -wordlist | list of words to bruteforce (file or comma separated or stdin) |
| hostsfile | BOOLEAN | -hostsfile | use system host file |
| resp-only | BOOLEAN | -resp-only | display dns response only |
| rate-limit | STRING | -rate-limit | number of dns request/second to make (disabled as default) (default -1) |
| exclude-type | STRING | -exclude-type | dns query type to exclude (a,aaaa,cname,ns,txt,srv,ptr,mx,soa,axfr,caa) (default none) |
| health-check | BOOLEAN | -health-check | run diagnostic check up |
| resolver-file | FILE | -resolver | list of resolvers to use (file) |
| wildcard-domain | STRING | -wildcard-domain | domain name for wildcard filtering (other flags will be ignored - only json output is supported) |
| wildcard-threshold | STRING | -wildcard-threshold | wildcard filter threshold (default 5) |
| trace-max-recursion | STRING | -trace-max-recursion | Max recursion for dns trace (default 32767) |
example
# resolve a host list and print each host with its DNS responsednsx -list hosts.txt -a -resp -silent -o resolved.txtwww.example.com [198.51.100.10]api.example.com [198.51.100.23]mail.example.com [198.51.100.24]app.example.com [198.51.100.42]vpn.example.com [198.51.100.57]dev.example.com [198.51.100.61]staging.example.com [198.51.100.61]cdn.example.com [198.51.100.78]guidance
Use dnsx to resolve, probe, and dedupe a host list at speed, or to brute-force subdomains with your own resolvers and wildcard filtering. It works on DNS, not HTTP, so follow it with httpx to find which resolved hosts serve web. For curating the resolver list it uses, run dnsvalidator first.
massdns-backed resolver and brute-forcer. dnsx adds record-type queries, ASN and CDN data, and JSONL in one binary.
Raw high-speed bulk resolver. dnsx layers filtering, brute force, and enrichment on top.
Broader DNS enumeration techniques. dnsx is faster for high-throughput resolution of a known list.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
A subdomain list feeds dnsx, which resolves and dedupes the hosts, then passes the live names to httpx so only responding hosts land as output.
Facts on this page come from the live Trickest tool library.