Skip to content
Deepak Gupta markRecon Atlas

DNS resolution and enumeration

shuffleDNS

Go wrapper around massdns that brute forces or resolves subdomains at high volume and filters wildcard DNS.

ActiveScope a pentestAudit your own exposure

1.7k stars · last push November 9, 2026 · v1.2.1 · GPL-3.0

GitHub repository

What it finds

shuffleDNS drives massdns to resolve a supplied subdomain list or to brute force names from a wordlist, using a resolver list you provide. Its main addition is wildcard handling: it tracks how many names point at one IP and checks each level for wildcards.

  • live subdomains
  • wildcard IPs

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

README: "allows you to enumerate valid subdomains using active bruteforce, as well as resolve subdomains with wildcard handling." The -mode flag selects bruteforce, resolve or filter; both send DNS queries through massdns.

API keys: The README requires massdns, a list of valid resolvers and a wordlist, and mentions no API keys.

Install

Install with go
go install -v github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Resolve a list of subdomains with wildcard filtering
shuffledns -d example.com -list example-subdomains.txt -r resolvers.txt -mode resolve

From the project's documentation

Resolve subdomains found passively by subfinder
subfinder -d example.com | shuffledns -d example.com -r resolvers.txt -mode resolve

From the project's documentation

Brute force subdomains from a wordlist
shuffledns -d example.com -w wordlist.txt -r resolvers.txt -mode bruteforce

From the project's documentation

Output formats: ndjson, txt

Limits the project documents

  • Requires massdns installed; on Windows you must supply the binary path.
  • Needs a list of valid resolvers and a wordlist that you supply.
  • Wildcard filtering works with domain (-d) input only.
  • Only one of resolving or brute forcing can run at a time.

Deepak's take

Analysis, not documentation

Use it when
Use it when you brute force large wordlists against your domain and need wildcard DNS filtered out of massdns results.
Skip it when
Skip it for small lists or record lookups, where dnsx needs no external massdns binary or resolver file.
What it will miss
It will not find names that are absent from your wordlist or input list.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: GPL-3.0. shuffleDNS is a trademark or project name of its owners; this library is not affiliated with it.