Skip to content
Deepak Gupta markRecon Atlas

DNS resolution and enumeration

MassDNS

High-performance DNS stub resolver in C for resolving millions of names, often used for subdomain brute forcing.

ActiveScope a pentestAudit your own exposure

3.7k stars · last push September 27, 2026 · v1.1.0 · GPL-3.0

GitHub repository

What it finds

MassDNS resolves very large name lists through a resolver file, and the README claims over 350,000 names per second with public resolvers. Bundled scripts generate brute-force candidates, pull names from crt.sh, build PTR queries, or query authoritative name servers directly.

  • DNS records
  • live subdomains
  • PTR names

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

Sends DNS queries for every input name. README: "Perform reconnaissance scans responsibly and adjust the -s parameter to not overwhelm authoritative name servers" and usage "may cause a significant load on the used resolvers and result in abuse complaints being sent to your ISP."

API keys: The README documents only a resolver list (-r) as input; no API keys are mentioned.

Install

Install with source
make

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Resolve AAAA records for a list of domains
./bin/massdns -r lists/resolvers.txt -t AAAA domains.txt > results.txt

From the project's documentation

Brute force subdomains with the bundled subbrute script
./scripts/subbrute.py example.com lists/names.txt | ./bin/massdns -r lists/resolvers.txt -t A -o S -w results.txt

From the project's documentation

Resolve names taken from certificate transparency logs
./scripts/ct.py example.com | ./bin/massdns -r lists/resolvers.txt -t A -o S -w results.txt

From the project's documentation

Query a domain's authoritative name servers directly
./bin/massdns -r <(./scripts/auth-addrs.sh example.com) --norecurse -o Je example-com-subdomains.txt > results.txt

From the project's documentation

Output formats: domain list, simple text, full text, binary, ndjson

Limits the project documents

  • The bundled resolver list is outdated, with a large share of dysfunctional resolvers, and is not guaranteed trustworthy.
  • No built-in wildcard detection (listed under Todo).
  • The custom DNS implementation supports only the most common record types.
  • recon.py handles zone delegation only up to the delegation point.
  • Build from source: run make, or make nolinux on non-Linux systems; Windows needs Cygwin.

Deepak's take

Analysis, not documentation

Use it when
Use it when raw resolution throughput is the bottleneck, such as multi-million-name wordlists against your domain from a high-bandwidth server.
Skip it when
Skip it when you want wildcard filtering and simple output; shuffledns wraps it for that, and dnsx covers smaller jobs.
What it will miss
It reports wildcard matches as real names, so results need a separate wildcard check.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: GPL-3.0. MassDNS is a trademark or project name of its owners; this library is not affiliated with it.