What is the -s option in massdns?

-s sets the number of concurrent lookups, the count of DNS queries massdns keeps in flight at once (default 10000). Raise it to push more throughput on a strong network and resolver pool; lower it to ease load. It is the main knob for resolution speed.

How does massdns use a resolvers.txt file?

Point -r at a text file of resolver IP addresses, one per line, and massdns spreads its queries across them. A large, healthy resolver list is what lets it reach hundreds of thousands of names per second. Stale or rate-limited resolvers drag down accuracy, so curate the list.

What does massdns take as input?

A file of domain names as the positional argument and a resolvers file via -r. It queries the resolvers concurrently and writes the answers to a file and a folder of results.

How do I keep only the responses I care about?

Use --filter to output only packets with a given response code, such as NOERROR, or --ignore to drop a code like NXDOMAIN. That trims a raw resolve down to the answered, live hosts.

What should run before and after massdns?

Before it, a brute-force or permutation tool to build the candidate list. After it, a prober like httpx and a scanner so probing and testing run only against names that resolve.

Updated Jul 14, 2026

Recon

Resolve millions of domain names with public DNS resolvers

A simple high-performance DNS stub resolver for resolving domains at massive scale.

Resolve a massive subdomain wordlist Validate enumerated subdomains Pull specific record types at scale

overview

What massdns does

MassDNS is a DNS stub resolver built for one job done well: turning a huge list of domain names into resolved records as fast as the network allows. You hand it a domains file and a list of public resolvers, and it fans queries across them, reaching hundreds of thousands of names per second without any special tuning. It is the engine behind much of modern subdomain resolution.

Speed at that scale needs control, so MassDNS exposes the knobs that matter. You pick the record type, set how many concurrent lookups run, decide how many times to retry a name before giving up, and choose which response codes to keep or drop. The result is a clean set of answers you can filter down to live hosts instead of a noisy dump.

On Trickest, MassDNS is a Recon node that reads a domains list and a resolvers file and writes a file and a folder of results. Generate candidate names with a permutation or brute-force tool, resolve them here, then pass the live hosts straight into a prober and scanner.

source github.com/blechschmidt/massdns

use cases

Where massdns fits

Resolve a massive subdomain wordlist

Feed a brute-force or permutation list of millions of candidate names through MassDNS and keep only the ones that resolve, cutting a huge guess set down to real hosts.

Validate enumerated subdomains

Run the output of passive subdomain discovery through MassDNS to drop dead names and confirm which domains still answer before you spend scanner time on them.

Pull specific record types at scale

Set the record type to A, CNAME, MX, or TXT and resolve an entire domain list in one pass to map infrastructure, mail routing, or ownership signals.

Feed a probing and scanning pipeline

Resolve candidate domains, hand the live hosts to httpx for liveness and tech detection, then to a vulnerability scanner so testing runs only against real targets.

reference

massdns inputs and flags

24 inputs

Name	Type	Flag	Description
domains-list	FILE	·	List of domain names to resolve, the primary positional input.
dns-resolvers-file	FILE	-r	Text file of DNS resolver IPs, one per line, to spread queries across.
concurent-lookups	STRING	-s	Number of concurrent lookups kept in flight; the main throughput knob (default 10000).
quiet-mode	BOOLEAN	-q	Quiet mode: suppress the progress statistics printed to stderr.
record-type	STRING	-t	Record type to resolve, such as A, CNAME, or MX (default A).
number-of-resolves	STRING	-c	Number of resolve attempts for a name before giving up (default 50).
filter-response-code-output	STRING	--filter	Only output packets with the specified response code.
number-of-processes	STRING	--processes	Number of processes to use for resolving (default 1).

Showing key inputs. massdns exposes 24 inputs in total.

Full flag reference (24 inputs)

Name	Type	Flag	Description
domains-list	FILE	·	List of domains to resolve, passed as the positional argument.
dns-resolvers-file	FILE	-r	Text file containing DNS resolvers.
record-type	STRING	-t	Record type to be resolved (default A).
concurent-lookups	STRING	-s	Number of concurrent lookups (default 10000).
quiet-mode	BOOLEAN	-q	Quiet mode: suppress progress statistics on stderr.
number-of-resolves	STRING	-c	Number of resolves for a name before giving up (default 50).
number-of-processes	STRING	--processes	Number of processes to be used for resolving (default 1).
sockets-per-process	STRING	--socket-count	Socket count per process (default 1).
verify-ip	BOOLEAN	--verify-ip	Verify IP addresses of incoming replies.
filter-response-code-output	STRING	--filter	Only output packets with the specified response code.
not-output-response-code	STRING	--ignore	Do not output packets with the specified response code.
unacceptable-response-codes	STRING	--retry	Unacceptable DNS response codes (default REFUSED).
time-to-wait-between-resolves	STRING	-i	Interval in milliseconds to wait between multiple resolves of the same domain (default 500).
non-reqursive-queries	BOOLEAN	--norecurse	Use non-recursive queries. Useful for DNS cache snooping.
dont-switch-resolver	BOOLEAN	--sticky	Do not switch the resolver when retrying.
use-resolvers-incrementaly	BOOLEAN	--predictable	Use resolvers incrementally. Useful for resolver tests.
flush-output-file	BOOLEAN	--flush	Flush the output file whenever a response was received.
bind-to-ip-and-port	STRING	-b	Bind to IP address and port (default 0.0.0.0:0).
send-buffer-size	STRING	--sndbuf	Size of the send buffer in bytes.
receive-buffer-size	STRING	--rcvbuf	Size of the receive buffer in bytes.
busy-wait-polling	BOOLEAN	--busy-poll	Use busy-wait polling instead of epoll.
dont-drop-priviliges	BOOLEAN	--root	Do not drop privileges when running as root. Not recommended.
drop-privileges-user	STRING	--drop-user	User to drop privileges to when running as root (default nobody).
drop-privileges-group	STRING	--drop-group	Group to drop privileges to when running as root (default nogroup).

example

Run massdns

massdns · command

# resolve a candidate list against public resolvers, write simple text outputmassdns -r resolvers.txt -t A -o S -w resolved.txt candidates.txt

sample output

api.example.com. A 203.0.113.10app.example.com. A 203.0.113.11mail.example.com. A 203.0.113.25staging.example.com. A 198.51.100.42dev.example.com. CNAME app-lb.example.com.app-lb.example.com. A 203.0.113.12vpn.example.com. A 198.51.100.77grafana.example.com. A 203.0.113.60

guidance

Choosing massdns

Reach for MassDNS when you need raw resolution throughput across millions of names. It resolves, it does not generate candidates, so pair it with a brute-force or permutation tool upstream. For accurate wildcard filtering and bruteforcing in one step, puredns wraps MassDNS with that logic built in.

puredns

Wraps MassDNS with wildcard detection and bruteforcing. Use it when you want filtered results without wiring the steps yourself.

shuffledns

A Go wrapper around MassDNS for subdomain enumeration and resolution. Friendlier interface, same engine underneath.

dnsx

A multi-purpose DNS toolkit with many probers. More features per record, less raw throughput than MassDNS.

faq

massdns questions

-q turns on quiet mode, which stops massdns from printing progress statistics to stderr. It does not set a queries-per-second rate, a common mix-up. Throughput is governed by -s, the number of concurrent lookups. On Trickest, toggle the quiet-mode input on the node.

Run massdns yourself

A candidate domain list and a resolvers file feed MassDNS, which resolves the names at scale and writes the live hosts as a queryable output.

Run massdns in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

domains-list

FILE

List of domain names to resolve, the primary positional input.

dns-resolvers-file

FILE

-r

Text file of DNS resolver IPs, one per line, to spread queries across.

concurent-lookups

STRING

-s

Number of concurrent lookups kept in flight; the main throughput knob (default 10000).

quiet-mode

BOOLEAN

-q

Quiet mode: suppress the progress statistics printed to stderr.

record-type

STRING

-t

Record type to resolve, such as A, CNAME, or MX (default A).

number-of-resolves

STRING

-c

Number of resolve attempts for a name before giving up (default 50).

filter-response-code-output

STRING

--filter

Only output packets with the specified response code.

number-of-processes

STRING

--processes

Number of processes to use for resolving (default 1).

Name

Type

Flag

Description

domains-list

FILE

List of domains to resolve, passed as the positional argument.

dns-resolvers-file

FILE

-r

Text file containing DNS resolvers.

record-type

STRING

-t

Record type to be resolved (default A).

concurent-lookups

STRING

-s

Number of concurrent lookups (default 10000).

quiet-mode

BOOLEAN

-q

Quiet mode: suppress progress statistics on stderr.

number-of-resolves

STRING

-c

Number of resolves for a name before giving up (default 50).

number-of-processes

STRING

--processes

Number of processes to be used for resolving (default 1).

sockets-per-process

STRING

--socket-count

Socket count per process (default 1).

verify-ip

BOOLEAN

--verify-ip

Verify IP addresses of incoming replies.

filter-response-code-output

STRING

--filter

Only output packets with the specified response code.

not-output-response-code

STRING

--ignore

Do not output packets with the specified response code.

unacceptable-response-codes

STRING

--retry

Unacceptable DNS response codes (default REFUSED).

time-to-wait-between-resolves

STRING

-i

Interval in milliseconds to wait between multiple resolves of the same domain (default 500).

non-reqursive-queries

BOOLEAN

--norecurse

Use non-recursive queries. Useful for DNS cache snooping.

dont-switch-resolver

BOOLEAN

--sticky

Do not switch the resolver when retrying.

use-resolvers-incrementaly

BOOLEAN

--predictable

Use resolvers incrementally. Useful for resolver tests.

flush-output-file

BOOLEAN

--flush

Flush the output file whenever a response was received.

bind-to-ip-and-port

STRING

-b

Bind to IP address and port (default 0.0.0.0:0).

send-buffer-size

STRING

--sndbuf

Size of the send buffer in bytes.

receive-buffer-size

STRING

--rcvbuf

Size of the receive buffer in bytes.

busy-wait-polling

BOOLEAN

--busy-poll

Use busy-wait polling instead of epoll.

dont-drop-priviliges

BOOLEAN

--root

Do not drop privileges when running as root. Not recommended.

drop-privileges-user

STRING

--drop-user

User to drop privileges to when running as root (default nobody).

drop-privileges-group

STRING

--drop-group

Group to drop privileges to when running as root (default nogroup).

api.example.com. A 203.0.113.10app.example.com. A 203.0.113.11mail.example.com. A 203.0.113.25staging.example.com. A 198.51.100.42dev.example.com. CNAME app-lb.example.com.app-lb.example.com. A 203.0.113.12vpn.example.com. A 198.51.100.77grafana.example.com. A 203.0.113.60

Resolve millions of domain names with public DNS resolvers

What massdns does

Where massdns fits

Resolve a massive subdomain wordlist

Validate enumerated subdomains

Pull specific record types at scale

Feed a probing and scanning pipeline

massdns inputs and flags

Run massdns

Choosing massdns

puredns

shuffledns

dnsx

massdns questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run massdns yourself

Resolve millions of domain names with public DNS resolvers

What massdns does

Where massdns fits

Resolve a massive subdomain wordlist

Validate enumerated subdomains

Pull specific record types at scale

Feed a probing and scanning pipeline

massdns inputs and flags

Run massdns

Choosing massdns

puredns

shuffledns

dnsx

massdns questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run massdns yourself