dnsx is a fast and multi-purpose DNS toolkit allow to run multiple probers using retryabledns library, that allows you to perform multiple DNS queries of your choice with a list of user supplied resolvers.
dnsx is successor of dnsprobe that includes new features, multiple bugs fixes, and tailored for better user experience, few notable flags are resp and resp-only that allows to control and print the exact information you are looking for.
We also ported DNS wildcard filtering feature to dnsx from shuffledns as a standalone support.
Simple and Handy utility to query DNS records.
Supports A, AAAA, CNAME, PTR, NS, MX, TXT, SOA
Handles wildcard subdomains in automated way.
Optimized for ease of use.
Stdin and stdout support to work with other tools.
The installation is easy. You can download the pre-built binaries for your platform from the Releases page. Extract them using tar, move it to your $PATH and you’re ready to go.
Download latest binary from https://github.com/projectdiscovery/dnsx/releases
▶ tar -xvf dnsx-linux-amd64.tar
▶ mv dnsx-linux-amd64 /usr/local/bin/dnsx
▶ dnsx -h
dnsx requires go1.15+ to install successfully. Run the following command to get the repo:
▶ GO111MODULE=on go get -v github.com/projectdiscovery/dnsx/cmd/dnsx
▶ git clone https://github.com/projectdiscovery/dnsx.git; cd dnsx/cmd/dnsx; go build; mv dnsx /usr/local/bin/; dnsx -version
Install via brew
If you’re macOS user and using Homebrew, you can install via brew command:
brew install dnsx
This will display help for the tool. Here are all the switches it supports.
Query A record
Query AAAA record
Query CNAME record
Query NS record
Query PTR record
Query TXT record
Query MX record
Query SOA record
Operates like dig
File input list of subdomains/host
dnsx -l list.txt
File or comma separated resolvers
dnsx -r 220.127.116.11
Limit of DNS request/second
dnsx -rl 100
Display response data
dnsx -cname -resp
Display only response data
dnsx -cname resp-only
Number of DNS retries
dnsx -retry 1
Show only results in the output
File to write output to (optional)
dnsx -o output.txt
Concurrent threads to make
dnsx -t 250
Show version of dnsx
Wildcard domain name for filtering
dnsx -wd example.com
Wildcard Filter Threshold
dnsx -wt 5
dnsx can be used to filter dead records from the list of passive subdomains obtained from various sources, for example
▶ subfinder -silent -d hackerone.com | dnsx
_ __ __
__| | _ __ ___ \ \/ /
/ _' || '_ \ / __| \ /
| (_| || | | |\__ \ / \
\__,_||_| |_||___//_/\_\ v1.0
[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
dnsx can be used to extract A records for the given list of subdomains, for example:
A special feature of dnsx is its ability to handle multi-level DNS based wildcards and do it so with very less number of DNS requests. Sometimes all the subdomains will resolve which will lead to lots of garbage in the results. The way dnsx handles this is it will keep track of how many subdomains point to an IP and if the count of the Subdomains increase beyond a certain small threshold, it will check for wildcard on all the levels of the hosts for that IP iteratively.