Brute-force and resolve subdomains, filtering wildcards out

puredns wraps massdns to resolve or brute-force enormous lists of subdomains at speed, then does the part that makes the results trustworthy: it strips wildcard responses and DNS-poisoned entries. Wildcard DNS makes every random name resolve, which floods a naive brute-force with junk, so puredns detects the wildcards and confirms real hits against trusted resolvers. What survives is signal, not noise.

Two modes cover the work. Bruteforce mode takes a domain and a wordlist and tests every generated name; resolve mode takes an existing list of names and confirms which ones answer. A pool of public resolvers carries the throughput under a --rate-limit you set, while a smaller --resolvers-trusted set validates the survivors so false positives and load-balanced records never leak through. Tune --wildcard-tests and --threads when a target's DNS fights back.

In a Trickest workflow, puredns is the resolution backbone of a subdomain pipeline. Feed it names from subfinder or a wordlist, and it writes a file and a folder of clean, resolved subdomains for httpx and the stages past it. Schedule the workflow and every run re-resolves the surface, so dead names drop off and new ones surface on their own.