dnsx: DNS resolution and record enumeration in recon

dnsx · MIT

dnsx is a fast DNS toolkit: it resolves hostnames, pulls records, and filters a list down to what actually exists. In a recon chain it is the filter between passive discovery, which over-reports, and active probing, which you only want pointed at real hosts.

Install

go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest

Core commands

# keep only hostnames that resolve
dnsx -l hosts.txt -silent

# resolve and show the A records
dnsx -l hosts.txt -silent -a -resp

# specific record types
dnsx -l hosts.txt -silent -cname -resp
dnsx -l roots.txt -silent -mx -resp
dnsx -l roots.txt -silent -txt -resp

# JSON for parsing
dnsx -l hosts.txt -json -o dns.jsonl -a -aaaa -cname

# brute-force a wordlist against a root
dnsx -d example.com -w words.txt -silent

Output

{"host":"api.example.com","a":["93.184.216.34"],"cname":["lb.example-cdn.net"],
 "status_code":"NOERROR"}

Where it sits in Tandera

dnsx runs in discovery on recon_web_lite and recon_web_full, immediately after the passive subdomain producers. Its job in the pipeline is twofold: drop hostnames that no longer resolve, and capture the CNAME chains that the takeover analysis later reads.

That second job matters. Tandera’s takeover enrichment compares CNAME targets against a fingerprint list of danglable services — the dnsx output is its input.

Using it in a pentest

CNAMEs are where subdomain takeover lives. A hostname that CNAMEs to a service that no longer exists is the classic finding. Pull CNAMEs explicitly (-cname -resp) rather than relying on A records alone, and look for targets pointing at storage buckets, PaaS apps and CDN endpoints.

Watch for wildcard DNS. If every random string resolves, your subdomain list is fiction. Test it directly:

echo "definitely-not-real-$RANDOM.example.com" | dnsx -silent -a -resp

If that returns an address, treat the whole enumeration as suspect and filter with -wd example.com to strip wildcard noise.

TXT records leak. SPF and DMARC entries routinely name third-party services and internal hostnames the organisation never intended to publish. dnsx -txt -resp on the root domain is thirty seconds well spent.