Skip to content
Deepak Gupta markRecon Atlas

DNS resolution and enumeration

dnsx

Fast DNS toolkit that resolves, queries record types, brute forces names and filters wildcard DNS for lists of hosts.

ActiveScope a pentestAudit your own exposure

2.9k stars · last push November 9, 2026 · v1.3.1 · MIT

GitHub repositoryOfficial docs

What it finds

dnsx sends DNS queries for lists of hosts or wordlist-generated names and reports records such as A, AAAA, CNAME, MX, TXT, NS and PTR. It can reverse-resolve IP ranges or ASNs through PTR lookups, attempt AXFR, and filter multi-level wildcard DNS.

  • live subdomains
  • DNS records
  • IP addresses
  • CNAME targets
  • ASN information
  • CDN names

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

Every mode sends DNS queries for the supplied names. README notes: "As default dnsx uses Google, Cloudflare, Quad9 resolver"; -d with -w brute forces subdomains, and -axfr queries AXFR (zone transfer).

API keys: The README documents no API key for resolving or brute forcing; it lists an -auth flag to "configure projectdiscovery cloud (pdcp) api key".

Install

Install with go
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest

From the project's documentation

Install with package
brew install dnsx

From the project's documentation

Install with docker
docker pull projectdiscovery/dnsx:latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Print A records for subdomains found by subfinder
subfinder -silent -d example.com | dnsx -silent -a -resp

From the project's documentation

Brute force subdomains of a domain with a wordlist
dnsx -silent -d example.com -w dns_worldlist.txt

From the project's documentation

Find hostnames in an IP range with PTR lookups
echo 192.0.2.0/24 | dnsx -silent -resp-only -ptr

From the project's documentation

Filter wildcard DNS automatically across many domains
dnsx -l subdomain_list.txt -auto-wildcard -o output.txt

From the project's documentation

Output formats: jsonl, txt, custom template

Limits the project documents

  • DNS resolution (-l) and DNS brute forcing (-w) cannot be used together.
  • -auto-wildcard and -wd are mutually exclusive; with -wd, other record flags are ignored.
  • VPN operators that filter high DNS/UDP traffic can cause packet loss.
  • -output-template cannot be combined with -json or -raw.

Deepak's take

Analysis, not documentation

Use it when
Use it to check which names from a passive list actually resolve, and to pull specific records such as CNAMEs or PTRs at speed.
Skip it when
Skip it for very large wordlist brute forces where massdns or shuffledns throughput matters more. It does not discover names from public data.
What it will miss
It only finds names you feed it or that your wordlist guesses, plus PTR names that exist for the IPs you supply.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: MIT. dnsx is a trademark or project name of its owners; this library is not affiliated with it.