Recon
Resolve candidate domain lists against public resolvers
DNS stub resolver for large domain lists.
overview
What massdns does
Feed a domains file and a resolvers list via -r. -t selects the record type; -s sets concurrent lookups. Output is answered names ready for probing.
Use it when a brute-force or permutation step produced a huge candidate set and you need raw resolution throughput. -c retries failed names; --filter keeps selected response codes.
puredns wraps massdns with wildcard filtering. shuffledns is a Go wrapper over the same engine. massdns alone resolves; it does not generate candidates.
use cases
Where massdns fits
Resolve a massive subdomain wordlist
Feed a brute-force or permutation list of millions of candidate names through MassDNS and keep only the ones that resolve, cutting a huge guess set down to real hosts.
Validate enumerated subdomains
Run the output of passive subdomain discovery through MassDNS to drop dead names and confirm which domains still answer before you spend scanner time on them.
Pull specific record types at scale
Set the record type to A, CNAME, MX, or TXT and resolve an entire domain list in one pass to map infrastructure, mail routing, or ownership signals.
Feed a probing and scanning pipeline
Resolve candidate domains, hand the live hosts to httpx for liveness and tech detection, then to a vulnerability scanner so testing runs only against real targets.
reference
massdns inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domains-list | FILE | · | List of domain names to resolve, the primary positional input. |
| dns-resolvers-file | FILE | -r | Text file of DNS resolver IPs, one per line, to spread queries across. |
| concurent-lookups | STRING | -s | Number of concurrent lookups kept in flight; the main throughput knob (default 10000). |
| quiet-mode | BOOLEAN | -q | Quiet mode: suppress the progress statistics printed to stderr. |
| record-type | STRING | -t | Record type to resolve, such as A, CNAME, or MX (default A). |
| number-of-resolves | STRING | -c | Number of resolve attempts for a name before giving up (default 50). |
| filter-response-code-output | STRING | --filter | Only output packets with the specified response code. |
| number-of-processes | STRING | --processes | Number of processes to use for resolving (default 1). |
Showing key inputs. massdns exposes 24 inputs in total.
Full flag reference (24 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| domains-list | FILE | · | List of domains to resolve, passed as the positional argument. |
| dns-resolvers-file | FILE | -r | Text file containing DNS resolvers. |
| record-type | STRING | -t | Record type to be resolved (default A). |
| concurent-lookups | STRING | -s | Number of concurrent lookups (default 10000). |
| quiet-mode | BOOLEAN | -q | Quiet mode: suppress progress statistics on stderr. |
| number-of-resolves | STRING | -c | Number of resolves for a name before giving up (default 50). |
| number-of-processes | STRING | --processes | Number of processes to be used for resolving (default 1). |
| sockets-per-process | STRING | --socket-count | Socket count per process (default 1). |
| verify-ip | BOOLEAN | --verify-ip | Verify IP addresses of incoming replies. |
| filter-response-code-output | STRING | --filter | Only output packets with the specified response code. |
| not-output-response-code | STRING | --ignore | Do not output packets with the specified response code. |
| unacceptable-response-codes | STRING | --retry | Unacceptable DNS response codes (default REFUSED). |
| time-to-wait-between-resolves | STRING | -i | Interval in milliseconds to wait between multiple resolves of the same domain (default 500). |
| non-reqursive-queries | BOOLEAN | --norecurse | Use non-recursive queries. Useful for DNS cache snooping. |
| dont-switch-resolver | BOOLEAN | --sticky | Do not switch the resolver when retrying. |
| use-resolvers-incrementaly | BOOLEAN | --predictable | Use resolvers incrementally. Useful for resolver tests. |
| flush-output-file | BOOLEAN | --flush | Flush the output file whenever a response was received. |
| bind-to-ip-and-port | STRING | -b | Bind to IP address and port (default 0.0.0.0:0). |
| send-buffer-size | STRING | --sndbuf | Size of the send buffer in bytes. |
| receive-buffer-size | STRING | --rcvbuf | Size of the receive buffer in bytes. |
| busy-wait-polling | BOOLEAN | --busy-poll | Use busy-wait polling instead of epoll. |
| dont-drop-priviliges | BOOLEAN | --root | Do not drop privileges when running as root. Not recommended. |
| drop-privileges-user | STRING | --drop-user | User to drop privileges to when running as root (default nobody). |
| drop-privileges-group | STRING | --drop-group | Group to drop privileges to when running as root (default nogroup). |
example
Run massdns
# resolve a candidate list against public resolvers, write simple text outputmassdns -r resolvers.txt -t A -o S -w resolved.txt candidates.txtapi.example.com. A 203.0.113.10app.example.com. A 203.0.113.11mail.example.com. A 203.0.113.25staging.example.com. A 198.51.100.42dev.example.com. CNAME app-lb.example.com.app-lb.example.com. A 203.0.113.12vpn.example.com. A 198.51.100.77grafana.example.com. A 203.0.113.60guidance
Choosing massdns
Use massdns for raw resolution throughput across large candidate lists. Pair a brute-force or permutation tool upstream. For wildcard filtering and bruteforcing in one step, use puredns.
puredns
Wraps massdns with wildcard detection and bruteforcing. Prefer it when you want filtered results without wiring those steps yourself.
shuffledns
Go wrapper around massdns for subdomain enumeration and resolution. Friendlier interface, same engine underneath.
dnsx
Multi-purpose DNS toolkit with more per-record probers. Less raw list throughput than massdns.
faq
massdns questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run massdns yourself
A candidate domain list and a resolvers file feed MassDNS, which resolves the names at scale and writes the live hosts as a queryable output.
Facts on this page come from the live Trickest tool library.