Recon
Permute known hosts into DNS candidates
Wordlist-driven subdomain permutations from known hosts.
overview
What goaltdns does
Place goaltdns between subdomain discovery and a DNS resolver. Feed seeds with -l or -h, point -w at a short permutation wordlist, and it writes a file and folder of candidate names for dnsx, puredns, or shuffledns.
Use it when you already have real hostnames and want dashed, numbered, and indexed variants shaped by the target. Keep -w small (dev, staging, api, internal) so the later resolve stage stays manageable.
Unlike a full subdomain brute force against the apex, goaltdns mutates names you already found. It does not resolve DNS. Trickest hosts it as a managed Recon node; wire output into a resolver or you only get unverified strings.
use cases
Where goaltdns fits
Permute known subdomains into candidates
Feed discovered names and a wordlist into goaltdns to generate dashed, numbered, and indexed variants tuned to the target's naming.
Expand a list of live hosts at once
Pass a file of live hosts with -l so goaltdns applies its permutation logic across the whole set rather than one host at a time.
Find hosts passive enumeration missed
Resolve the permuted names to surface obscure subdomains that certificate logs and DNS aggregators never recorded.
Tune the wordlist to a target's naming
Point -w at a small permutation wordlist of real segments like dev, staging, api, and internal so the tool generates believable variants instead of noise.
reference
goaltdns inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| wordlist | FILE | -w | Custom wordlist used to permute the seed names. |
| live-hosts | FILE | -l | List of live hosts to permute. |
| host-to-permutate | STRING | -h | A single host to permute. |
Showing key inputs. goaltdns exposes 3 inputs in total.
example
Run goaltdns
# permute known hosts against a wordlist, save the candidate namesgoaltdns -l known-hosts.txt -w permutations.txt -o goaltdns-out.txtadmin.dev.example.comdev-admin.example.comdev.admin.example.comapi-staging.example.comstaging-api.example.comstaging1.example.comstaging-2.example.comdev.api.example.comapi-dev.example.commail-vpn.example.comguidance
Choosing goaltdns
Use after subdomain discovery and before a DNS resolver, when you want wordlist-driven permutations from known hosts. It generates names only. Follow with dnsx, puredns, or shuffledns. Prefer alterx or gotator when you need pattern templates or depth controls.
alterx
Pattern-driven permutation generator with -pattern and -enrich. Prefer when you need a DSL over a simple -w wordlist.
gotator
Permutation generator with depth and number options. Close peer when those knobs matter more than a plain wordlist.
dnsgen
Generates name variants from a domain list. Pair any of these with a resolver to confirm hits.
faq
goaltdns questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run goaltdns yourself
Known hosts feed goaltdns, which permutes them against a wordlist and passes the candidates to dnsx so only names that resolve land as output.
Facts on this page come from the live Trickest tool library.