Recon
Resolve and filter DNS records from a host list
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
overview
What dnsx does
Feed dnsx a subdomain or host list with -list and your own -resolver set. With -resp it prints each host next to its answer; with -resp-only it emits only the values for the next stage.
Query A (-a, default), CNAME (-cname), or every type with -recon. Filter by status with -rcode, annotate with -asn or -cdn, and strip wildcard noise with -wildcard-domain.
For brute force, pass -domain and -wordlist in one run. Trickest captures FILE and FOLDER output; add -json for JSONL. Resolve after discovery, then hand live names to httpx.
use cases
Where dnsx fits
Resolve a discovered subdomain set
Run a passive finder's output through dnsx with your own resolvers to keep only names that resolve, deduplicated and ready for probing.
Brute-force subdomains with a wordlist
Feed a domain and a wordlist so dnsx generates candidates and resolves them in one pass, with wildcard filtering to drop noise.
Pull specific DNS records at scale
Query MX, NS, TXT, or CNAME across a host list, or use recon mode for everything, emitting JSONL for downstream analysis.
Enrich hosts with ASN and CDN data
Add ASN and CDN annotations during resolution so later stages can route or scope by network and infrastructure provider.
reference
dnsx inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| list | FILE | -list | List of subdomains or hosts to resolve (file or stdin). |
| resp | BOOLEAN | -resp | Display each host alongside its DNS response. |
| resp-only | BOOLEAN | -resp-only | Display only the DNS response value, without the host. |
| a | BOOLEAN | -a | Query the A record (the default query type). |
| cname | BOOLEAN | -cname | Query the CNAME record. |
| recon | BOOLEAN | -recon | Query every DNS record type in one pass. |
| resolver | STRING | -resolver | Resolvers to use, comma-separated. |
| json | BOOLEAN | -json | Write output in JSONL format. |
Showing key inputs. dnsx exposes 40 inputs in total.
Full flag reference (40 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| a | BOOLEAN | -a | query A record (default) |
| mx | BOOLEAN | -mx | query MX record |
| ns | BOOLEAN | -ns | query NS record |
| any | BOOLEAN | -any | query ANY record |
| asn | BOOLEAN | -asn | display host asn information |
| caa | BOOLEAN | -caa | query CAA record |
| cdn | BOOLEAN | -cdn | display cdn name |
| ptr | BOOLEAN | -ptr | query PTR record |
| soa | BOOLEAN | -soa | query SOA record |
| srv | BOOLEAN | -srv | query SRV record |
| txt | BOOLEAN | -txt | query TXT record |
| aaaa | BOOLEAN | -aaaa | query AAAA record |
| axfr | BOOLEAN | -axfr | query AXFR |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| list | FILE | -list | list of sub(domains)/hosts to resolve (file or stdin) |
| resp | BOOLEAN | -resp | display dns response |
| cname | BOOLEAN | -cname | query CNAME record |
| debug | BOOLEAN | -debug | display raw dns response |
| rcode | STRING | -rcode | filter result by dns status code (eg. -rcode noerror,servfail,refused) |
| recon | BOOLEAN | -recon | query all the dns records (a,aaaa,cname,ns,txt,srv,ptr,mx,soa,axfr,caa) |
| retry | STRING | -retry | number of dns attempts to make (must be at least 1) (default 2) |
| stats | BOOLEAN | -stats | display stats of the running scan |
| trace | BOOLEAN | -trace | perform dns tracing |
| domain | FILE | -domain | list of domain to bruteforce (file or comma separated or stdin) |
| silent | BOOLEAN | -silent | display only results in the output |
| threads | STRING | -threads | number of concurrent threads to use (default 100) |
| verbose | BOOLEAN | -verbose | display verbose output |
| no-color | BOOLEAN | -no-color | disable color in output |
| omit-raw | BOOLEAN | -omit-raw | omit raw dns response from jsonl output |
| resolver | STRING | -resolver | list of resolvers to use (comma separated) |
| wordlist | FILE | -wordlist | list of words to bruteforce (file or comma separated or stdin) |
| hostsfile | BOOLEAN | -hostsfile | use system host file |
| resp-only | BOOLEAN | -resp-only | display dns response only |
| rate-limit | STRING | -rate-limit | number of dns request/second to make (disabled as default) (default -1) |
| exclude-type | STRING | -exclude-type | dns query type to exclude (a,aaaa,cname,ns,txt,srv,ptr,mx,soa,axfr,caa) (default none) |
| health-check | BOOLEAN | -health-check | run diagnostic check up |
| resolver-file | FILE | -resolver | list of resolvers to use (file) |
| wildcard-domain | STRING | -wildcard-domain | domain name for wildcard filtering (other flags will be ignored - only json output is supported) |
| wildcard-threshold | STRING | -wildcard-threshold | wildcard filter threshold (default 5) |
| trace-max-recursion | STRING | -trace-max-recursion | Max recursion for dns trace (default 32767) |
example
Run dnsx
# resolve a host list and print each host with its DNS responsednsx -list hosts.txt -a -resp -silent -o resolved.txtwww.example.com [198.51.100.10]api.example.com [198.51.100.23]mail.example.com [198.51.100.24]app.example.com [198.51.100.42]vpn.example.com [198.51.100.57]dev.example.com [198.51.100.61]staging.example.com [198.51.100.61]cdn.example.com [198.51.100.78]guidance
Choosing dnsx
Use dnsx to resolve, probe, and dedupe a host list, or to brute-force subdomains with your own resolvers and wildcard filtering. It works on DNS, not HTTP, so follow it with httpx for web probes. Curate the resolver list with dnsvalidator first.
shuffledns
massdns-backed resolver and brute-forcer. dnsx adds record-type queries, ASN and CDN data, and JSONL in one binary.
massdns
Raw bulk resolver. dnsx layers filtering, brute force, and enrichment on top.
dnsrecon
Broader DNS enumeration techniques. dnsx targets high-throughput resolution of a known list.
workflows
Workflows using dnsx
Find Origin IPs Behind Cloudflare
Find the origin server behind Cloudflare or another WAF by resolving subdomains, filtering CDN ranges, and confirming which IP serves the site.
Find Subdomain Takeovers
Find dangling CNAMEs an attacker could claim on your subdomains, with the service behind each record named so you know who to ask.
Multi-Cloud Dangling DNS
Bind AWS, GCP, Azure, and Cloudflare vault config into findmytakeover; emit dangling-DNS findings and an evidence report.
Subdomain Enumeration
Find every subdomain of a domain from passive sources and certificate transparency, then resolve and probe the hosts that answer.
faq
dnsx questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run dnsx yourself
A subdomain list feeds dnsx, which resolves and dedupes the hosts, then passes the live names to httpx so only responding hosts land as output.
Facts on this page come from the live Trickest tool library.