loading
Loading content
loading
Recon
DNS stub resolver for large domain lists.
overview
Feed a domains file and a resolvers list via -r. -t selects the record type; -s sets concurrent lookups. Output is answered names ready for probing.
Use it when a brute-force or permutation step produced a huge candidate set and you need raw resolution throughput. -c retries failed names; --filter keeps selected response codes.
puredns wraps massdns with wildcard filtering. shuffledns is a Go wrapper over the same engine. massdns alone resolves; it does not generate candidates.
use cases
Feed a brute-force or permutation list of millions of candidate names through MassDNS and keep only the ones that resolve, cutting a huge guess set down to real hosts.
Run the output of passive subdomain discovery through MassDNS to drop dead names and confirm which domains still answer before you spend scanner time on them.
Set the record type to A, CNAME, MX, or TXT and resolve an entire domain list in one pass to map infrastructure, mail routing, or ownership signals.
Resolve candidate domains, hand the live hosts to httpx for liveness and tech detection, then to a vulnerability scanner so testing runs only against real targets.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domains-list | FILE | · | List of domain names to resolve, the primary positional input. |
| dns-resolvers-file | FILE | -r | Text file of DNS resolver IPs, one per line, to spread queries across. |
| concurent-lookups | STRING | -s | Number of concurrent lookups kept in flight; the main throughput knob (default 10000). |
| quiet-mode | BOOLEAN | -q | Quiet mode: suppress the progress statistics printed to stderr. |
| record-type | STRING | -t | Record type to resolve, such as A, CNAME, or MX (default A). |
| number-of-resolves | STRING | -c | Number of resolve attempts for a name before giving up (default 50). |
| filter-response-code-output | STRING | --filter | Only output packets with the specified response code. |
| number-of-processes | STRING | --processes | Number of processes to use for resolving (default 1). |
Showing key inputs. massdns exposes 24 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| domains-list | FILE | · | List of domains to resolve, passed as the positional argument. |
| dns-resolvers-file | FILE | -r | Text file containing DNS resolvers. |
| record-type | STRING | -t | Record type to be resolved (default A). |
| concurent-lookups | STRING | -s | Number of concurrent lookups (default 10000). |
| quiet-mode | BOOLEAN | -q | Quiet mode: suppress progress statistics on stderr. |
| number-of-resolves | STRING | -c | Number of resolves for a name before giving up (default 50). |
| number-of-processes | STRING | --processes | Number of processes to be used for resolving (default 1). |
| sockets-per-process | STRING | --socket-count | Socket count per process (default 1). |
| verify-ip | BOOLEAN | --verify-ip | Verify IP addresses of incoming replies. |
| filter-response-code-output | STRING | --filter | Only output packets with the specified response code. |
| not-output-response-code | STRING | --ignore | Do not output packets with the specified response code. |
| unacceptable-response-codes | STRING | --retry | Unacceptable DNS response codes (default REFUSED). |
| time-to-wait-between-resolves | STRING | -i | Interval in milliseconds to wait between multiple resolves of the same domain (default 500). |
| non-reqursive-queries | BOOLEAN | --norecurse | Use non-recursive queries. Useful for DNS cache snooping. |
| dont-switch-resolver | BOOLEAN | --sticky | Do not switch the resolver when retrying. |
| use-resolvers-incrementaly | BOOLEAN | --predictable | Use resolvers incrementally. Useful for resolver tests. |
| flush-output-file | BOOLEAN | --flush | Flush the output file whenever a response was received. |
| bind-to-ip-and-port | STRING | -b | Bind to IP address and port (default 0.0.0.0:0). |
| send-buffer-size | STRING | --sndbuf | Size of the send buffer in bytes. |
| receive-buffer-size | STRING | --rcvbuf | Size of the receive buffer in bytes. |
| busy-wait-polling | BOOLEAN | --busy-poll | Use busy-wait polling instead of epoll. |
| dont-drop-priviliges | BOOLEAN | --root | Do not drop privileges when running as root. Not recommended. |
| drop-privileges-user | STRING | --drop-user | User to drop privileges to when running as root (default nobody). |
| drop-privileges-group | STRING | --drop-group | Group to drop privileges to when running as root (default nogroup). |
example
# resolve a candidate list against public resolvers, write simple text outputmassdns -r resolvers.txt -t A -o S -w resolved.txt candidates.txtapi.example.com. A 203.0.113.10app.example.com. A 203.0.113.11mail.example.com. A 203.0.113.25staging.example.com. A 198.51.100.42dev.example.com. CNAME app-lb.example.com.app-lb.example.com. A 203.0.113.12vpn.example.com. A 198.51.100.77grafana.example.com. A 203.0.113.60guidance
Use massdns for raw resolution throughput across large candidate lists. Pair a brute-force or permutation tool upstream. For wildcard filtering and bruteforcing in one step, use puredns.
Wraps massdns with wildcard detection and bruteforcing. Prefer it when you want filtered results without wiring those steps yourself.
Go wrapper around massdns for subdomain enumeration and resolution. Friendlier interface, same engine underneath.
Multi-purpose DNS toolkit with more per-record probers. Less raw list throughput than massdns.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A candidate domain list and a resolvers file feed MassDNS, which resolves the names at scale and writes the live hosts as a queryable output.
Facts on this page come from the live Trickest tool library.