loading
Loading content
loading
Recon
Fast CLI DNS lookup tool.
overview
zdns resolves DNS at scale from the command line. Built by the ZMap team, it reads a list of names and queries them with thousands of lightweight goroutines, so resolving a large host list takes seconds rather than minutes. It supports a wide range of record types, from A and AAAA to MX, NS, TXT, CAA, and many more, selected by a module argument.
It is more than a bulk resolver. zdns can run its own iterative resolution instead of leaning on a recursive resolver, query over DNS-over-TLS or DNS-over-HTTPS, request DNSSEC records and validate them, and target a specific set of nameservers. Threads, retries, timeouts, and a result-verbosity setting let you balance speed against completeness for the job at hand.
On Trickest, zdns is a Recon node that reads a list of names and writes a file and a folder of structured results. Run it after subdomain discovery to resolve candidate names to IPs, or use it as a standalone DNS survey step whose output feeds port scanning and probing downstream.
source github.com/zmap/zdns
use cases
Feed thousands of discovered subdomains into zdns and tune --threads to resolve them to A and AAAA records in one quick pass.
Select a module such as MX, NS, TXT, or CAA to pull exactly the records you need for mail, delegation, or policy mapping across a domain set.
Use --iterative so zdns walks the delegation chain itself instead of trusting a recursive resolver, which gives authoritative answers for a survey.
Query with --tls or --https and verify the server certificate to test how a name resolves through a private or hardened resolver.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| module | STRING | · | Record type or lookup module to run (A, AAAA, MX, NS, TXT, CAA, and many more). |
| input-file | FILE | · | Input file of names to resolve. |
| name-servers | STRING | --name-servers | Comma-delimited list of DNS servers to use. |
| threads | STRING | --threads | Number of lightweight goroutines (default 1000). |
| iterative | BOOLEAN | --iterative | Perform own iteration instead of using a recursive resolver. |
| dnssec | BOOLEAN | --dnssec | Request DNSSEC records by setting the DO bit. |
| tls | BOOLEAN | --tls | Use DNS over TLS for lookups. |
| timeout | STRING | --timeout | Timeout for resolving an individual name (default 20). |
Showing key inputs. zdns exposes 47 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| tls | BOOLEAN | --tls | Use DNS over TLS for lookups, mutually exclusive with --udp-only, --iterative, and --https |
| nsid | BOOLEAN | --nsid | Request NSID. |
| alexa | BOOLEAN | --alexa | is input file from Alexa Top Million download |
| class | STRING | --class | DNS class to query. Options: INET, CSNET, CHAOS, HESIOD, NONE, ANY. (default: INET) |
| https | BOOLEAN | --https | Use DNS over HTTPS for lookups, mutually exclusive with --udp-only, --iterative, and --tls |
| input | STRING | · | Input target |
| quiet | BOOLEAN | --quiet | do not print status updates |
| dnssec | BOOLEAN | --dnssec | Requests DNSSEC records by setting the DNSSEC OK (DO) bit |
| module | STRING | · | module (one command of: A, AAAA, AFSDB, ALOOKUP, AMTRELAY, ANY, APL, ATMA, AVC, AXFR, BINDVERSION, CAA, CDNSKEY, CDS, CERT, CNAME, CSYNC, DHCID, DMARC, DNAME, DNSKEY, DS, EID, EUI48, EUI64, GID, GPOS, HINFO, HIP, HTTPS, IPSECKEY, ISDN, KEY, KX, L32, L64, LOC, LP, MB, MD, MF, MG, MINFO, MR, MULTIPLE, MX, MXLOOKUP, NAPTR, NID, NIMLOC, NINFO, NONE, NS, NSAPPTR, NSEC, NSEC3, NSEC3PARAM, NSLOOKUP, NULL, NXNAME, NXT, OPENPGPKEY, OPT, PTR, PX, RKEY, RP, RRSIG, RT, SIG, SMIMEA, SOA, SPF, SPF, SRV, SSHFP, SVCB, TALINK, TKEY, TLSA, TXT, UID, UINFO, UNSPEC, URI, X25 or ZONEMD) |
| prefix | STRING | --prefix | name to be prepended to what's passed in (e.g., www.) |
| retries | STRING | --retries | how many times should zdns retry query if timeout or temporary failure (default 3) |
| threads | STRING | --threads | number of lightweight go threads (default 1000) |
| timeout | STRING | --timeout | timeout for resolving an individual name (default 20) |
| tcp-only | BOOLEAN | --tcp-only | Only perform lookups over TCP |
| udp-only | BOOLEAN | --udp-only | Only perform lookups over UDP |
| conf-file | FILE | --conf-file | config file for DNS servers (default "/etc/resolv.conf") |
| iterative | BOOLEAN | --iterative | Perform own iteration instead of relying on recursive resolver |
| max-depth | STRING | --max-depth | how deep should we recurse when performing iterative lookups (default 10) |
| verbosity | STRING | --verbosity | log verbosity: 1 (lowest)--5 (highest) (default 3) |
| cache-size | STRING | --cache-size | how many items can be stored in internal recursive cache (default 10000) |
| input-file | FILE | · | Input file |
| local-addr | STRING | --local-addr | comma-delimited list of local addresses to use, serve as the source IP for outbound queries |
| nanoseconds | BOOLEAN | --nanoseconds | Use nanosecond resolution timestamps |
| go-processes | STRING | --go-processes | number of OS processes to use, GOMAXPROCS if 0 (default: 0) |
| name-servers | STRING | --name-servers | List of DNS servers to use. Can be passed as comma-delimited string. If no port is specified, defaults to 53. If not provided, defaults to either the default root servers in --iterative or the recursive resolvers specified in /etc/resolv.conf or OS equivalent. |
| client-subnet | STRING | --client-subnet | Client subnet in CIDR format for EDNS0. |
| override-name | STRING | --override-name | name overrides all passed in names. Commonly used with --name-server-mode. |
| root-cas-file | FILE | --root-cas-file | Path to a file containing PEM-encoded root CAs to use for verifying server certificates, required for --verify-server-cert |
| blacklist-file | FILE | --blacklist-file | blacklist file for servers to exclude from lookups |
| include-fields | STRING | --include-fields | Comma separated list of fields to additionally output beyond result verbosity. Options: class, protocol, ttl, resolver, flags, dnssec |
| ipv4-transport | BOOLEAN | --4 | utilize IPv4 query transport only, incompatible with --6 |
| ipv6-transport | BOOLEAN | --6 | utilize IPv6 query transport only, incompatible with --4 |
| all-nameservers | BOOLEAN | --all-nameservers | Behavior is dependent on --iterative. In --iterative, --all-name-servers will query all root servers, then all gtld servers, etc. recording the responses at each layer. In non-iterative mode, the query will be sent to all external resolvers specified in --name-servers. |
| local-interface | STRING | --local-interface | local interface to use |
| network-timeout | STRING | --network-timeout | timeout for round trip network operations, in seconds (default 2) |
| validate-dnssec | BOOLEAN | --validate-dnssec | Validate DNSSEC records, only applicable with --iterative |
| name-server-mode | BOOLEAN | --name-server-mode | Treats input as nameservers to query with a static query rather than queries to send to a static name server |
| no-follow-cnames | BOOLEAN | --no-follow-cnames | do not follow CNAMEs/DNAMEs in the lookup process |
| result-verbosity | STRING | --result-verbosity | Sets verbosity of each output record. Options: short, normal, long, trace (default: normal) |
| checking-disabled | BOOLEAN | --checking-disabled | Sends DNS packets with the CD bit set |
| iteration-timeout | STRING | --iteration-timeout | timeout for a single iterative step in an iterative query, in seconds. Only applicable with --iterative (default: 8) |
| multi-config-file | FILE | --multi-config-file | config file path for multiple module configurations |
| no-recycle-sockets | BOOLEAN | --no-recycle-sockets | do not create long-lived unbound UDP socket for each thread at launch and reuse for all (UDP) queries |
| verify-server-cert | BOOLEAN | --verify-server-cert | Verify the server's certificate when using DNS over TLS or DNS over HTTPS |
| metadata-passthrough | BOOLEAN | --metadata-passthrough | if input records have the form 'name,METADATA', METADATA will be propagated to the output |
| prefer-ipv4-iteration | BOOLEAN | --prefer-ipv4-iteration | Prefer IPv4/A record lookups during iterative resolution. Ignored unless used with both IPv4 and IPv6 query transport |
| prefer-ipv6-iteration | BOOLEAN | --prefer-ipv6-iteration | Prefer IPv6/AAAA record lookups during iterative resolution. Ignored unless used with both IPv4 and IPv6 query transport |
example
# A lookup with high concurrency against a recursive resolverzdns A --threads 1000 --timeout 20 --retries 3 --name-servers 198.51.100.53 --quiet example.com{"name":"api.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.10"}]}}{"name":"app.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.20"}]}}{"name":"mail.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"203.0.113.5"}]}}{"name":"vpn.example.com","status":"NOERROR","data":{"answers":[{"ttl":60,"type":"A","class":"IN","answer":"203.0.113.8"}]}}{"name":"staging.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.30"}]}}{"name":"cdn.example.com","status":"NOERROR","data":{"answers":[{"ttl":60,"type":"A","class":"IN","answer":"198.51.100.40"}]}}{"name":"dev.example.com","status":"NXDOMAIN","data":{}}{"name":"www.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.1"}]}}guidance
Use zdns to resolve many names quickly with control over record types, transport, and iteration. It resolves names, it does not discover them, so feed it subdomain output from subfinder. For active brute-force resolving of a wordlist, pair it with a tool like puredns.
Fast multi-purpose DNS toolkit. A close alternative with handy probing filters built in.
High-performance stub resolver for huge lists. zdns adds iterative mode and more record types.
Resolver wrapper with wildcard filtering for brute forcing. Use it when generating and resolving names.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
A domain feeds subfinder, which discovers subdomains and passes them to zdns so only names that resolve land as a queryable output.
Facts on this page come from the live Trickest tool library.