Does shuffledns brute-force or resolve?

Both. Pass -w to generate and test new names, or -list to resolve candidates you already have. -raw-input re-processes prior massdns output.

What resolver file does -r expect?

A plain text file of DNS resolver IPs, one per line. massdns queries them in parallel, so keep the list current. Stale resolvers return poisoned or dead answers.

How does -strict-wildcard cut false positives?

Many domains answer for any name. -strict-wildcard checks every found subdomain against that wildcard behavior and drops the fakes. -wt controls how many wildcard checks run at once.

How is shuffledns different from puredns?

Both wrap massdns for fast brute force and resolution with wildcard filtering. shuffledns is the ProjectDiscovery wrapper. Pick whichever already fits your pipeline; the massdns core is the same.

Updated Jul 14, 2026

Recon

Resolve wordlist candidates through massdns

massdns wrapper for active subdomain brute force and resolution with wildcard filtering.

Brute-force subdomains at scale Resolve a passive subdomain list Filter wildcard false positives

overview

What shuffledns does

shuffledns wraps massdns for two jobs: brute-force new names from a wordlist (-w) against a domain (-d), or resolve an existing candidate list (-list) through resolvers (-r).

Wildcard DNS answers flood naive brute-force runs. -strict-wildcard checks each hit; -wt tunes concurrent wildcard checks so false positives do not drown real hosts.

Sit it after a passive subdomain source when you need live answers, or in brute mode when wordlist coverage matters. Feed resolved hosts to a prober next.

source github.com/projectdiscovery/shuffledns

use cases

Where shuffledns fits

Brute-force subdomains at scale

Feed a domain, a wordlist, and a resolver list to discover new subdomains fast, with wildcard responses filtered out automatically.

Resolve a passive subdomain list

Run resolve mode over subdomains gathered from passive sources to confirm which ones answer before probing.

Filter wildcard false positives

Use strict wildcard checking so domains that answer for any name do not flood the result set with hosts that do not exist.

Tune throughput for big runs

Raise concurrent massdns resolves and wildcard checks to push a large wordlist through quickly without overwhelming the resolvers.

reference

shuffledns inputs and flags

12 inputs

Name	Type	Flag	Description
domain	STRING	-d	Domain to find or resolve subdomains for.
wordlist	FILE	-w	File of words to brute-force subdomains from.
resolvers	FILE	-r	File of DNS resolvers to use for enumeration.
subdomains	FILE	-list	File of subdomains to resolve in resolve mode.
strict-wildcard	BOOLEAN	-strict-wildcard	Perform a wildcard check on every found subdomain.
massdns-command	STRING	-massdns-cmd	Optional massdns commands to forward (example '-i 10').
massdns-resolves	STRING	-t	Number of concurrent massdns resolves (default 10000).
show-only-subdomains	BOOLEAN	-silent	Show only subdomains in the output.

Showing key inputs. shuffledns exposes 12 inputs in total.

Full flag reference (12 inputs)

Name	Type	Flag	Description
domain	STRING	-d	Domain to find or resolve subdomains for.
no-color	BOOLEAN	-no-color	don't use colors in output
wordlist	FILE	-w	file containing words for subdomain bruteforce
resolvers	FILE	-r	file containing resolvers for enumeration
subdomains	FILE	-list	file containing list of subdomains to resolve
massdns-input	FILE	-raw-input	file containing full massdns output
massdns-command	STRING	-massdns-cmd	optional massdns commands to run (example '-i 10')
strict-wildcard	BOOLEAN	-strict-wildcard	perform wildcard check on all found subdomains
massdns-resolves	STRING	-t	number of concurrent massdns resolves (default 10000)
number-of-retries	STRING	-retries	number of retries for DNS enumeration (default 5)
show-only-subdomains	BOOLEAN	-silent	show only subdomains in output
number-of-wildcard-checks	STRING	-wt	number of concurrent wildcard checks (default 25)

example

Run shuffledns

shuffledns · command

# brute-force subdomains from a wordlist with wildcard filteringshuffledns -d example.com -w subdomains.txt -r resolvers.txt -strict-wildcard -o resolved.txt

sample output

www.example.comapi.example.commail.example.comdev.example.comstaging.example.comvpn.example.comadmin.example.comgrafana.example.com…  (valid hosts after wildcard filtering; a full wordlist run against a live domain returns many more)

guidance

Choosing shuffledns

Use shuffledns for active subdomain brute force or high-speed resolution when you have a resolver list (-r). For passive names with no traffic to the target, pull from securitytrails-subdomains first, then resolve here.

securitytrails-subdomains

Passive subdomain source. Feed its output into shuffledns -list resolve mode to validate hosts.

shodan-python

Service intelligence rather than DNS brute force. A different recon lens on the same target.

snallygaster

Web-server file exposure checks. Run later against resolved hosts, not for DNS discovery.

faq

shuffledns questions

Set -d for the domain, -w for the wordlist, and -r for resolvers. shuffledns builds candidates, resolves them through massdns, and writes names that answer. On Trickest, map those to the domain, wordlist, and resolvers inputs.

Run shuffledns yourself

A domain and a wordlist feed shuffledns, which brute-forces and resolves subdomains with wildcard filtering and writes the valid hosts.

Open shuffledns in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Resolve wordlist candidates through massdns

What shuffledns does

Where shuffledns fits

Brute-force subdomains at scale

Resolve a passive subdomain list

Filter wildcard false positives

Tune throughput for big runs

shuffledns inputs and flags

Run shuffledns

Choosing shuffledns

securitytrails-subdomains

shodan-python

snallygaster

shuffledns questions

More Recon tools

amass

amass-intel

assetfinder

bbot

bevigil

cloud-enum

Run shuffledns yourself