Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Recon

Resolve wordlist candidates through massdns

shuffledns is a ProjectDiscovery wrapper around massdns for subdomain brute-forcing and resolution, filtering wildcard DNS entries and validating results against a supplied resolver list.

installgo install -v github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest

Go · GPL-3.0 license

Agent
Brute-force subdomains at scaleResolve a passive subdomain listFilter wildcard false positives

overview

What shuffledns does

shuffledns wraps massdns for two jobs: brute-force new names from a wordlist (-w) against a domain (-d), or resolve an existing candidate list (-list) through resolvers (-r).

Wildcard DNS answers flood naive brute-force runs. -strict-wildcard checks each hit; -wt tunes concurrent wildcard checks so false positives do not drown real hosts.

Sit it after a passive subdomain source when you need live answers, or in brute mode when wordlist coverage matters. Feed resolved hosts to a prober next.

source github.com/projectdiscovery/shuffledns

use cases

Where shuffledns fits

Brute-force subdomains at scale

Feed a domain, a wordlist, and a resolver list to discover new subdomains fast, with wildcard responses filtered out automatically.

Resolve a passive subdomain list

Run resolve mode over subdomains gathered from passive sources to confirm which ones answer before probing.

Filter wildcard false positives

Use strict wildcard checking so domains that answer for any name do not flood the result set with hosts that do not exist.

Tune throughput for big runs

Raise concurrent massdns resolves and wildcard checks to push a large wordlist through quickly without overwhelming the resolvers.

reference

shuffledns inputs and flags

12 inputs
NameTypeFlagDescription
domainSTRING-dDomain to find or resolve subdomains for.
wordlistFILE-wFile of words to brute-force subdomains from.
resolversFILE-rFile of DNS resolvers to use for enumeration.
subdomainsFILE-listFile of subdomains to resolve in resolve mode.
strict-wildcardBOOLEAN-strict-wildcardPerform a wildcard check on every found subdomain.
massdns-commandSTRING-massdns-cmdOptional massdns commands to forward (example '-i 10').
massdns-resolvesSTRING-tNumber of concurrent massdns resolves (default 10000).
show-only-subdomainsBOOLEAN-silentShow only subdomains in the output.

Showing key inputs. shuffledns exposes 12 inputs in total.

Full flag reference (12 inputs)
NameTypeFlagDescription
domainSTRING-dDomain to find or resolve subdomains for.
no-colorBOOLEAN-no-colordon't use colors in output
wordlistFILE-wfile containing words for subdomain bruteforce
resolversFILE-rfile containing resolvers for enumeration
subdomainsFILE-listfile containing list of subdomains to resolve
massdns-inputFILE-raw-inputfile containing full massdns output
massdns-commandSTRING-massdns-cmdoptional massdns commands to run (example '-i 10')
strict-wildcardBOOLEAN-strict-wildcardperform wildcard check on all found subdomains
massdns-resolvesSTRING-tnumber of concurrent massdns resolves (default 10000)
number-of-retriesSTRING-retriesnumber of retries for DNS enumeration (default 5)
show-only-subdomainsBOOLEAN-silentshow only subdomains in output
number-of-wildcard-checksSTRING-wtnumber of concurrent wildcard checks (default 25)

example

Run shuffledns

shuffledns · command
# brute-force subdomains from a wordlist with wildcard filtering
shuffledns -d example.com -w subdomains.txt -r resolvers.txt -strict-wildcard -o resolved.txt
sample output
www.example.com
api.example.com
mail.example.com
dev.example.com
staging.example.com
vpn.example.com
admin.example.com
grafana.example.com
…  (valid hosts after wildcard filtering; a full wordlist run against a live domain returns many more)

guidance

Choosing shuffledns

Use shuffledns for active subdomain brute force or high-speed resolution when you have a resolver list (-r). For passive names with no traffic to the target, pull from securitytrails-subdomains first, then resolve here.

securitytrails-subdomains

Passive subdomain source. Feed its output into shuffledns -list resolve mode to validate hosts.

shodan-python

Service intelligence rather than DNS brute force. A different recon lens on the same target.

snallygaster

Web-server file exposure checks. Run later against resolved hosts, not for DNS discovery.

faq

shuffledns questions

Set -d for the domain, -w for the wordlist, and -r for resolvers. shuffledns builds candidates, resolves them through massdns, and writes names that answer. On Trickest, map those to the domain, wordlist, and resolvers inputs.

Both. Pass -w to generate and test new names, or -list to resolve candidates you already have. -raw-input re-processes prior massdns output.

A plain text file of DNS resolver IPs, one per line. massdns queries them in parallel, so keep the list current. Stale resolvers return poisoned or dead answers.

Many domains answer for any name. -strict-wildcard checks every found subdomain against that wildcard behavior and drops the fakes. -wt controls how many wildcard checks run at once.

Both wrap massdns for fast brute force and resolution with wildcard filtering. shuffledns is the ProjectDiscovery wrapper. Pick whichever already fits your pipeline; the massdns core is the same.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run shuffledns yourself

A domain and a wordlist feed shuffledns, which brute-forces and resolves subdomains with wildcard filtering and writes the valid hosts.

Open shuffledns in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.