Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Recon

Resolve bulk DNS lookups across many record types

CLI DNS lookup for bulk name lists.

Agent
Resolve a large name list fastQuery specific record typesRun iterative resolution

overview

What zdns does

zdns resolves DNS from the command line against a list of names. Built by the ZMap team, it queries with many lightweight goroutines and supports a wide range of record types (A, AAAA, MX, NS, TXT, CAA, and more) selected by a module argument. It resolves names; it does not discover them.

Beyond recursive lookups, --iterative walks the delegation chain itself. --tls and --https use encrypted transport. --dnssec requests DNSSEC records. --name-servers pins resolvers. --threads, --retries, and --timeout balance throughput against completeness for the job.

Trickest runs it as a managed Recon node that reads a name list and writes FILE and FOLDER results. Place it after subdomain discovery so candidate names resolve to IPs before port scanning and probing. For active wordlist brute-force with wildcard filtering, prefer puredns.

source github.com/zmap/zdns

use cases

Where zdns fits

Resolve a large name list fast

Feed thousands of discovered subdomains into zdns and tune --threads to resolve them to A and AAAA records in one quick pass.

Query specific record types

Select a module such as MX, NS, TXT, or CAA to pull exactly the records you need for mail, delegation, or policy mapping across a domain set.

Run iterative resolution

Use --iterative so zdns walks the delegation chain itself instead of trusting a recursive resolver, which gives authoritative answers for a survey.

Resolve over encrypted transport

Query with --tls or --https and verify the server certificate to test how a name resolves through a private or hardened resolver.

reference

zdns inputs and flags

47 inputs
NameTypeFlagDescription
moduleSTRING·Record type or lookup module to run (A, AAAA, MX, NS, TXT, CAA, and many more).
input-fileFILE·Input file of names to resolve.
name-serversSTRING--name-serversComma-delimited list of DNS servers to use.
threadsSTRING--threadsNumber of lightweight goroutines (default 1000).
iterativeBOOLEAN--iterativePerform own iteration instead of using a recursive resolver.
dnssecBOOLEAN--dnssecRequest DNSSEC records by setting the DO bit.
tlsBOOLEAN--tlsUse DNS over TLS for lookups.
timeoutSTRING--timeoutTimeout for resolving an individual name (default 20).

Showing key inputs. zdns exposes 47 inputs in total.

Full flag reference (47 inputs)
NameTypeFlagDescription
tlsBOOLEAN--tlsUse DNS over TLS for lookups, mutually exclusive with --udp-only, --iterative, and --https
nsidBOOLEAN--nsidRequest NSID.
alexaBOOLEAN--alexais input file from Alexa Top Million download
classSTRING--classDNS class to query. Options: INET, CSNET, CHAOS, HESIOD, NONE, ANY. (default: INET)
httpsBOOLEAN--httpsUse DNS over HTTPS for lookups, mutually exclusive with --udp-only, --iterative, and --tls
inputSTRING·Input target
quietBOOLEAN--quietdo not print status updates
dnssecBOOLEAN--dnssecRequests DNSSEC records by setting the DNSSEC OK (DO) bit
moduleSTRING·module (one command of: A, AAAA, AFSDB, ALOOKUP, AMTRELAY, ANY, APL, ATMA, AVC, AXFR, BINDVERSION, CAA, CDNSKEY, CDS, CERT, CNAME, CSYNC, DHCID, DMARC, DNAME, DNSKEY, DS, EID, EUI48, EUI64, GID, GPOS, HINFO, HIP, HTTPS, IPSECKEY, ISDN, KEY, KX, L32, L64, LOC, LP, MB, MD, MF, MG, MINFO, MR, MULTIPLE, MX, MXLOOKUP, NAPTR, NID, NIMLOC, NINFO, NONE, NS, NSAPPTR, NSEC, NSEC3, NSEC3PARAM, NSLOOKUP, NULL, NXNAME, NXT, OPENPGPKEY, OPT, PTR, PX, RKEY, RP, RRSIG, RT, SIG, SMIMEA, SOA, SPF, SPF, SRV, SSHFP, SVCB, TALINK, TKEY, TLSA, TXT, UID, UINFO, UNSPEC, URI, X25 or ZONEMD)
prefixSTRING--prefixname to be prepended to what's passed in (e.g., www.)
retriesSTRING--retrieshow many times should zdns retry query if timeout or temporary failure (default 3)
threadsSTRING--threadsnumber of lightweight go threads (default 1000)
timeoutSTRING--timeouttimeout for resolving an individual name (default 20)
tcp-onlyBOOLEAN--tcp-onlyOnly perform lookups over TCP
udp-onlyBOOLEAN--udp-onlyOnly perform lookups over UDP
conf-fileFILE--conf-fileconfig file for DNS servers (default "/etc/resolv.conf")
iterativeBOOLEAN--iterativePerform own iteration instead of relying on recursive resolver
max-depthSTRING--max-depthhow deep should we recurse when performing iterative lookups (default 10)
verbositySTRING--verbositylog verbosity: 1 (lowest)--5 (highest) (default 3)
cache-sizeSTRING--cache-sizehow many items can be stored in internal recursive cache (default 10000)
input-fileFILE·Input file
local-addrSTRING--local-addrcomma-delimited list of local addresses to use, serve as the source IP for outbound queries
nanosecondsBOOLEAN--nanosecondsUse nanosecond resolution timestamps
go-processesSTRING--go-processesnumber of OS processes to use, GOMAXPROCS if 0 (default: 0)
name-serversSTRING--name-serversList of DNS servers to use. Can be passed as comma-delimited string. If no port is specified, defaults to 53. If not provided, defaults to either the default root servers in --iterative or the recursive resolvers specified in /etc/resolv.conf or OS equivalent.
client-subnetSTRING--client-subnetClient subnet in CIDR format for EDNS0.
override-nameSTRING--override-namename overrides all passed in names. Commonly used with --name-server-mode.
root-cas-fileFILE--root-cas-filePath to a file containing PEM-encoded root CAs to use for verifying server certificates, required for --verify-server-cert
blacklist-fileFILE--blacklist-fileblacklist file for servers to exclude from lookups
include-fieldsSTRING--include-fieldsComma separated list of fields to additionally output beyond result verbosity. Options: class, protocol, ttl, resolver, flags, dnssec
ipv4-transportBOOLEAN--4utilize IPv4 query transport only, incompatible with --6
ipv6-transportBOOLEAN--6utilize IPv6 query transport only, incompatible with --4
all-nameserversBOOLEAN--all-nameserversBehavior is dependent on --iterative. In --iterative, --all-name-servers will query all root servers, then all gtld servers, etc. recording the responses at each layer. In non-iterative mode, the query will be sent to all external resolvers specified in --name-servers.
local-interfaceSTRING--local-interfacelocal interface to use
network-timeoutSTRING--network-timeouttimeout for round trip network operations, in seconds (default 2)
validate-dnssecBOOLEAN--validate-dnssecValidate DNSSEC records, only applicable with --iterative
name-server-modeBOOLEAN--name-server-modeTreats input as nameservers to query with a static query rather than queries to send to a static name server
no-follow-cnamesBOOLEAN--no-follow-cnamesdo not follow CNAMEs/DNAMEs in the lookup process
result-verbositySTRING--result-verbositySets verbosity of each output record. Options: short, normal, long, trace (default: normal)
checking-disabledBOOLEAN--checking-disabledSends DNS packets with the CD bit set
iteration-timeoutSTRING--iteration-timeouttimeout for a single iterative step in an iterative query, in seconds. Only applicable with --iterative (default: 8)
multi-config-fileFILE--multi-config-fileconfig file path for multiple module configurations
no-recycle-socketsBOOLEAN--no-recycle-socketsdo not create long-lived unbound UDP socket for each thread at launch and reuse for all (UDP) queries
verify-server-certBOOLEAN--verify-server-certVerify the server's certificate when using DNS over TLS or DNS over HTTPS
metadata-passthroughBOOLEAN--metadata-passthroughif input records have the form 'name,METADATA', METADATA will be propagated to the output
prefer-ipv4-iterationBOOLEAN--prefer-ipv4-iterationPrefer IPv4/A record lookups during iterative resolution. Ignored unless used with both IPv4 and IPv6 query transport
prefer-ipv6-iterationBOOLEAN--prefer-ipv6-iterationPrefer IPv6/AAAA record lookups during iterative resolution. Ignored unless used with both IPv4 and IPv6 query transport

example

Run zdns

zdns · command
# A lookup with high concurrency against a recursive resolverzdns A --threads 1000 --timeout 20 --retries 3 --name-servers 198.51.100.53 --quiet example.com
sample output
{"name":"api.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.10"}]}}{"name":"app.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.20"}]}}{"name":"mail.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"203.0.113.5"}]}}{"name":"vpn.example.com","status":"NOERROR","data":{"answers":[{"ttl":60,"type":"A","class":"IN","answer":"203.0.113.8"}]}}{"name":"staging.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.30"}]}}{"name":"cdn.example.com","status":"NOERROR","data":{"answers":[{"ttl":60,"type":"A","class":"IN","answer":"198.51.100.40"}]}}{"name":"dev.example.com","status":"NXDOMAIN","data":{}}{"name":"www.example.com","status":"NOERROR","data":{"answers":[{"ttl":300,"type":"A","class":"IN","answer":"198.51.100.1"}]}}

guidance

Choosing zdns

Use zdns to resolve many names with control over record type, transport, and iteration. Feed it subdomain output from a discovery tool such as subfinder. For active brute-force resolving of a wordlist with wildcard filtering, pair or prefer puredns.

dnsx

Multi-purpose DNS toolkit with probing filters built in.

massdns

High-throughput stub resolver for huge lists. zdns adds iterative mode and more record types.

puredns

Resolver wrapper with wildcard filtering for brute forcing. Use it when generating and resolving names.

faq

zdns questions

A wide range selected by the module argument, including A, AAAA, MX, NS, TXT, CAA, SOA, SRV, and many others. One type per run.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run zdns yourself

A domain feeds subfinder, which discovers subdomains and passes them to zdns so only names that resolve land as a queryable output.

Open zdns in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.