loading
Loading content
loading
Recon
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
overview
Feed dnsx a subdomain or host list with -list and your own -resolver set. With -resp it prints each host next to its answer; with -resp-only it emits only the values for the next stage.
Query A (-a, default), CNAME (-cname), or every type with -recon. Filter by status with -rcode, annotate with -asn or -cdn, and strip wildcard noise with -wildcard-domain.
For brute force, pass -domain and -wordlist in one run. Trickest captures FILE and FOLDER output; add -json for JSONL. Resolve after discovery, then hand live names to httpx.
use cases
Run a passive finder's output through dnsx with your own resolvers to keep only names that resolve, deduplicated and ready for probing.
Feed a domain and a wordlist so dnsx generates candidates and resolves them in one pass, with wildcard filtering to drop noise.
Query MX, NS, TXT, or CNAME across a host list, or use recon mode for everything, emitting JSONL for downstream analysis.
Add ASN and CDN annotations during resolution so later stages can route or scope by network and infrastructure provider.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| list | FILE | -list | List of subdomains or hosts to resolve (file or stdin). |
| resp | BOOLEAN | -resp | Display each host alongside its DNS response. |
| resp-only | BOOLEAN | -resp-only | Display only the DNS response value, without the host. |
| a | BOOLEAN | -a | Query the A record (the default query type). |
| cname | BOOLEAN | -cname | Query the CNAME record. |
| recon | BOOLEAN | -recon | Query every DNS record type in one pass. |
| resolver | STRING | -resolver | Resolvers to use, comma-separated. |
| json | BOOLEAN | -json | Write output in JSONL format. |
Showing key inputs. dnsx exposes 40 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| a | BOOLEAN | -a | query A record (default) |
| mx | BOOLEAN | -mx | query MX record |
| ns | BOOLEAN | -ns | query NS record |
| any | BOOLEAN | -any | query ANY record |
| asn | BOOLEAN | -asn | display host asn information |
| caa | BOOLEAN | -caa | query CAA record |
| cdn | BOOLEAN | -cdn | display cdn name |
| ptr | BOOLEAN | -ptr | query PTR record |
| soa | BOOLEAN | -soa | query SOA record |
| srv | BOOLEAN | -srv | query SRV record |
| txt | BOOLEAN | -txt | query TXT record |
| aaaa | BOOLEAN | -aaaa | query AAAA record |
| axfr | BOOLEAN | -axfr | query AXFR |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| list | FILE | -list | list of sub(domains)/hosts to resolve (file or stdin) |
| resp | BOOLEAN | -resp | display dns response |
| cname | BOOLEAN | -cname | query CNAME record |
| debug | BOOLEAN | -debug | display raw dns response |
| rcode | STRING | -rcode | filter result by dns status code (eg. -rcode noerror,servfail,refused) |
| recon | BOOLEAN | -recon | query all the dns records (a,aaaa,cname,ns,txt,srv,ptr,mx,soa,axfr,caa) |
| retry | STRING | -retry | number of dns attempts to make (must be at least 1) (default 2) |
| stats | BOOLEAN | -stats | display stats of the running scan |
| trace | BOOLEAN | -trace | perform dns tracing |
| domain | FILE | -domain | list of domain to bruteforce (file or comma separated or stdin) |
| silent | BOOLEAN | -silent | display only results in the output |
| threads | STRING | -threads | number of concurrent threads to use (default 100) |
| verbose | BOOLEAN | -verbose | display verbose output |
| no-color | BOOLEAN | -no-color | disable color in output |
| omit-raw | BOOLEAN | -omit-raw | omit raw dns response from jsonl output |
| resolver | STRING | -resolver | list of resolvers to use (comma separated) |
| wordlist | FILE | -wordlist | list of words to bruteforce (file or comma separated or stdin) |
| hostsfile | BOOLEAN | -hostsfile | use system host file |
| resp-only | BOOLEAN | -resp-only | display dns response only |
| rate-limit | STRING | -rate-limit | number of dns request/second to make (disabled as default) (default -1) |
| exclude-type | STRING | -exclude-type | dns query type to exclude (a,aaaa,cname,ns,txt,srv,ptr,mx,soa,axfr,caa) (default none) |
| health-check | BOOLEAN | -health-check | run diagnostic check up |
| resolver-file | FILE | -resolver | list of resolvers to use (file) |
| wildcard-domain | STRING | -wildcard-domain | domain name for wildcard filtering (other flags will be ignored - only json output is supported) |
| wildcard-threshold | STRING | -wildcard-threshold | wildcard filter threshold (default 5) |
| trace-max-recursion | STRING | -trace-max-recursion | Max recursion for dns trace (default 32767) |
example
# resolve a host list and print each host with its DNS responsednsx -list hosts.txt -a -resp -silent -o resolved.txtwww.example.com [198.51.100.10]api.example.com [198.51.100.23]mail.example.com [198.51.100.24]app.example.com [198.51.100.42]vpn.example.com [198.51.100.57]dev.example.com [198.51.100.61]staging.example.com [198.51.100.61]cdn.example.com [198.51.100.78]guidance
Use dnsx to resolve, probe, and dedupe a host list, or to brute-force subdomains with your own resolvers and wildcard filtering. It works on DNS, not HTTP, so follow it with httpx for web probes. Curate the resolver list with dnsvalidator first.
massdns-backed resolver and brute-forcer. dnsx adds record-type queries, ASN and CDN data, and JSONL in one binary.
Raw bulk resolver. dnsx layers filtering, brute force, and enrichment on top.
Broader DNS enumeration techniques. dnsx targets high-throughput resolution of a known list.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A subdomain list feeds dnsx, which resolves and dedupes the hosts, then passes the live names to httpx so only responding hosts land as output.
Facts on this page come from the live Trickest tool library.