# dnsx: DNS resolution and record enumeration in recon

> How to install and run dnsx, what its record output looks like, and why Tandera resolves every discovered hostname before probing it.

`dnsx` is a fast DNS toolkit: it resolves hostnames, pulls records, and filters a list down to what actually exists. In a recon chain it is the filter between passive discovery, which over-reports, and active probing, which you only want pointed at real hosts.

## Install

```bash
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
```

## Core commands

```bash
# keep only hostnames that resolve
dnsx -l hosts.txt -silent

# resolve and show the A records
dnsx -l hosts.txt -silent -a -resp

# specific record types
dnsx -l hosts.txt -silent -cname -resp
dnsx -l roots.txt -silent -mx -resp
dnsx -l roots.txt -silent -txt -resp

# JSON for parsing
dnsx -l hosts.txt -json -o dns.jsonl -a -aaaa -cname

# brute-force a wordlist against a root
dnsx -d example.com -w words.txt -silent
```

## Output

```json
{"host":"api.example.com","a":["93.184.216.34"],"cname":["lb.example-cdn.net"],
 "status_code":"NOERROR"}
```

## Where it sits in Tandera

dnsx runs in **discovery** on `recon_web_lite` and `recon_web_full`, immediately after the passive subdomain producers. Its job in the pipeline is twofold: drop hostnames that no longer resolve, and capture the CNAME chains that the takeover analysis later reads.

That second job matters. Tandera's `takeover` enrichment compares CNAME targets against a fingerprint list of danglable services — the dnsx output is its input.

## Using it in a pentest

**CNAMEs are where subdomain takeover lives.** A hostname that CNAMEs to a service that no longer exists is the classic finding. Pull CNAMEs explicitly (`-cname -resp`) rather than relying on A records alone, and look for targets pointing at storage buckets, PaaS apps and CDN endpoints.

**Watch for wildcard DNS.** If every random string resolves, your subdomain list is fiction. Test it directly:

```bash
echo "definitely-not-real-$RANDOM.example.com" | dnsx -silent -a -resp
```

If that returns an address, treat the whole enumeration as suspect and filter with `-wd example.com` to strip wildcard noise.

**TXT records leak.** SPF and DMARC entries routinely name third-party services and internal hostnames the organisation never intended to publish. `dnsx -txt -resp` on the root domain is thirty seconds well spent.

---

Canonical: https://tandera.io/tools/dnsx
This page as markdown: https://tandera.io/tools/dnsx.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.