aeondave/dnsx

dnsx

Fast DNS toolkit — resolve, brute-force, and extract DNS records at scale.

Quick Start

# Resolve a list of subdomains
cat subs.txt | dnsx

# DNS brute-force against a domain
dnsx -d example.com -w wordlist.txt

# Extract A records with response
cat subs.txt | dnsx -a -resp

Core Flags

| Flag | Description | |------|-------------| | -l <file> | Input list of hosts/subdomains | | -d <domain> | Target domain (for brute-force) | | -w <wordlist> | Wordlist for brute-force | | -a | Query A records | | -aaaa | Query AAAA records | | -cname | Query CNAME records | | -mx | Query MX records | | -ns | Query NS records | | -txt | Query TXT records | | -ptr | Query PTR records | | -resp | Show DNS response | | -resp-only | Show DNS response only | | -rcode <code> | Filter by rcode (e.g., noerror,nxdomain) | | -r <resolvers> | Custom resolver file | | -rl <n> | Rate limit (requests/second) | | -t <n> | Threads (default 100) | | -timeout <n> | Timeout (default 5s) | | -silent | Print results only | | -o <file> | Output file | | -json | JSON output | | -wildcard | Filter wildcard subdomains | | -cdn | Show CDN name for resolved IPs | | -asn | Show ASN info for resolved IPs | | -recon | Query all record types at once | | -wt <n> | Wildcard threshold (default 5) | | -retry <n> | Retry failed queries |

Common Workflows

# Pipeline: subfinder -> dnsx resolution
subfinder -d target.com -silent | dnsx -silent

# DNS brute-force with wordlist
dnsx -d target.com -w /usr/share/dnsrecon/subdomains-top1mil-5000.txt -t 50

# Get all record types in JSON
cat subs.txt | dnsx -a -cname -mx -txt -resp -o dns_records.json -json

# Resolve IPs for a list
cat domains.txt | dnsx -a -resp-only | sort -u

# Filter wildcard results
cat subs.txt | dnsx -wildcard -d target.com -silent

# Reverse DNS (PTR) on IPs
cat ips.txt | dnsx -ptr -resp-only

# Full recon pipeline: subfinder -> dnsx -> httpx
subfinder -d target.com -silent -all | \
  dnsx -silent -a -resp-only | \
  httpx -silent -status-code -title -tech-detect

# Extract MX/TXT for email security audit
dnsx -d target.com -mx -txt -resp -silent

# Brute-force with custom resolvers (bypass rate limits)
dnsx -d target.com -w subdomains.txt -r resolvers.txt -rl 500

# Wildcard detection + filter
dnsx -d target.com -w wordlist.txt -wildcard -wt 3 -silent

# Extract CNAMEs (find dangling/takeovers)
cat subs.txt | dnsx -cname -resp -silent | grep -v "target.com"

Resources

| File | When to load | |------|--------------| | references/dns-records.md | DNS record types, brute-force wordlists, wildcard detection, subdomain takeover |