What wordlist should I pass to --subs?

A newline-delimited file of candidate labels, one per line, like api, mail, dev, or staging. Coverage scales with the list: a larger wordlist finds more names but takes longer, so raise --process_count to keep the run fast. Trickest ships curated DNS wordlists you can wire straight into the node.

How do I point subbrute at my own resolvers?

Pass a resolver file with --resolvers, one IP per line. Leave it empty and subbrute falls back to its bundled resolvers.txt. Fresh, working open resolvers matter: dead or rate-limited resolvers slow the run and drop answers, so many teams refresh the list from a validated resolver source before a big brute.

How does subbrute avoid DNS rate limiting?

It routes lookups through open resolvers instead of hitting the target's own name servers. Queries fan out across the resolver pool, so no single server sees enough traffic to throttle you, and the target's DNS never sees the brute force directly. That resolver-as-proxy design also adds a layer of anonymity.

Does subbrute do subdomain permutations or recursive brute forcing?

The node resolves exactly the labels in your wordlist; it does not mutate known names into new guesses. For permutation-style discovery (dev1, dev-staging, api-eu), generate a mutated wordlist with a tool like gotator or altdns first, then feed that list to subbrute through --subs.

subbrute vs subfinder or aiodnsbrute?

subfinder is passive: it pulls names from third-party datasets and touches no target infrastructure. aiodnsbrute is an async brute-forcer that resolves directly. subbrute sits between them, brute forcing a wordlist but routing every query through open resolvers to stay off the target's name servers. Run a passive pass and a brute pass, then merge for the widest set.

Can subbrute show the DNS records it finds?

Yes. Add -p and subbrute prints the data from each found record instead of the hostname alone, which is useful when you want A or CNAME values inline. Turn on --verbose for debug output while you tune a run.

Updated Jul 14, 2026

Recon

Brute-force a domain's subdomains through open resolvers

A fast, accurate subdomain enumeration tool that brute-forces names through open resolvers.

Brute-force names passive tools miss Stay off the target's name servers Combine with passive enumeration

overview

What subbrute does

subbrute takes a target domain and a wordlist of candidate labels, then resolves every name to learn which ones exist. It generates the names itself rather than reading a dataset, so it surfaces hosts that never appear in certificate transparency logs, search results, or DNS aggregators.

The trick is the open resolver. Instead of querying the target's own name servers, subbrute spreads lookups across a pool of public resolvers, which sidesteps per-server DNS rate limiting and keeps brute-force traffic off the target's infrastructure. The community project behind it aimed for the fastest, most accurate DNS brute forcing, and the resolver pool is how it gets there.

Reach for subbrute when passive discovery has run dry and you want the long tail of guessable names. On Trickest, the node takes a target and a --subs wordlist and writes a file and folder of resolved subdomains; merge those with a passive finder like subfinder, then hand the union to httpx to see which names respond.

source github.com/TheRook/subbrute

use cases

Where subbrute fits

Brute-force names passive tools miss

Resolve a wordlist against a domain to find subdomains that never show up in certificate logs or search-engine sources.

Stay off the target's name servers

Route queries through open resolvers so brute forcing dodges rate limits and sends no direct traffic to the target's DNS.

Combine with passive enumeration

Merge subbrute's brute-forced names with a passive finder's output for a fuller subdomain set before probing.

Enumerate many domains at once

Supply a --targets file of domains and brute-force every one of them in a single pass.

reference

subbrute inputs and flags

7 inputs

Name	Type	Flag	Description
target	STRING	·	Target domain to brute-force subdomains for (positional).
subs	FILE	--subs	A file with the list of candidate subdomain labels to try.
targets	FILE	--targets	A file of newline-delimited domains to brute-force in one run.
resolvers	FILE	--resolvers	A file of DNS resolvers; falls back to the internal resolvers.txt if empty.
process-count	STRING	--process_count	Number of lookup threads to run (default 8).
print-data	BOOLEAN	-p	Print the data from found DNS records instead of the hostname alone (default false).

Showing key inputs. subbrute exposes 7 inputs in total.

Full flag reference (7 inputs)

Name	Type	Flag	Description
subs	FILE	--subs	A file with the list of candidate subdomain labels.
target	STRING	·	Target domain to brute-force subdomains for (positional).
targets	FILE	--targets	A file containing a newline-delimited list of domains to brute-force.
verbose	BOOLEAN	--verbose	Print debug information.
resolvers	FILE	--resolvers	A file with a list of DNS resolvers; uses the internal resolvers.txt if empty.
print-data	BOOLEAN	-p	Print data from found DNS records (default false).
process-count	STRING	--process_count	Number of lookup threads to run (default 8).

example

Run subbrute

subbrute · command

# brute-force subdomains through open resolvers, 16 lookup threadssubbrute --subs /wordlists/dns/names.txt --resolvers resolvers.txt --process_count 16 example.com

sample output

ns1.example.commail.example.comvpn.example.comapi.example.comdev.example.comstaging.example.comautodiscover.example.comowa.example.com

guidance

Choosing subbrute

Use subbrute for active subdomain brute forcing when you want names that passive sources never see. It generates and resolves names, so pair it with a passive finder like subfinder for coverage and follow both with httpx to find live hosts. Supply fresh open resolvers for speed.

subfinder

Passive enumeration from datasets. subbrute brute-forces names; run both and merge for fuller coverage.

aiodnsbrute

Async DNS brute-forcer. subbrute's open-resolver routing keeps queries off the target's name servers.

faq

subbrute questions

You give it a target domain and a wordlist of candidate labels through --subs. subbrute prepends each label to the domain, resolves the name through a pool of DNS resolvers, and keeps the ones that answer. Names that never resolve are dropped, so the output is a clean list of subdomains that resolve.

Run subbrute yourself

A domain and a subdomain wordlist feed subbrute, which resolves names through open resolvers and writes the discovered subdomains as output.

Run subbrute in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target

STRING

Target domain to brute-force subdomains for (positional).

subs

FILE

--subs

A file with the list of candidate subdomain labels to try.

targets

FILE

--targets

A file of newline-delimited domains to brute-force in one run.

resolvers

FILE

--resolvers

A file of DNS resolvers; falls back to the internal resolvers.txt if empty.

process-count

STRING

--process_count

Number of lookup threads to run (default 8).

print-data

BOOLEAN

-p

Print the data from found DNS records instead of the hostname alone (default false).

Name

Type

Flag

Description

subs

FILE

--subs

A file with the list of candidate subdomain labels.

target

STRING

Target domain to brute-force subdomains for (positional).

targets

FILE

--targets

A file containing a newline-delimited list of domains to brute-force.

verbose

BOOLEAN

--verbose

Print debug information.

resolvers

FILE

--resolvers

A file with a list of DNS resolvers; uses the internal resolvers.txt if empty.

print-data

BOOLEAN

-p

Print data from found DNS records (default false).

process-count

STRING

--process_count

Number of lookup threads to run (default 8).

Brute-force a domain's subdomains through open resolvers

What subbrute does

Where subbrute fits

Brute-force names passive tools miss

Stay off the target's name servers

Combine with passive enumeration

Enumerate many domains at once

subbrute inputs and flags

Run subbrute

Choosing subbrute

subfinder

aiodnsbrute

subbrute questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run subbrute yourself

Brute-force a domain's subdomains through open resolvers

What subbrute does

Where subbrute fits

Brute-force names passive tools miss

Stay off the target's name servers

Combine with passive enumeration

Enumerate many domains at once

subbrute inputs and flags

Run subbrute

Choosing subbrute

subfinder

aiodnsbrute

subbrute questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run subbrute yourself