dnsx
A fast and multi-purpose DNS toolkit to run multiple DNS queries.
Note: input to dnsx
needs to be passed through stdin
(pipe |
) in some cases.
See also: dig
, dog
, dnstracer
.
More information: https://github.com/projectdiscovery/dnsx.
- Query the A record of a (sub)domain and show [re]sponse received:
echo
example.com | dnsx -a -re
- Query all the DNS records (A, AAAA, CNAME, NS, TXT, SRV, PTR, MX, SOA, AXFR, CAA):
dnsx -recon -re <<<
example.com
- Query a specific type of DNS record:
echo
example.com | dnsx -re -
a|aaaa|cname|ns|txt|srv|ptr|mx|soa|any|axfr|caa
- Output [r]esponse [o]nly (do not show the queried domain or subdomain):
echo
example.com | dnsx -ro
- Display raw response of a query, specifying [r]esolvers to use and retry attempts for failures:
echo
example.com | dnsx -
debug|raw -resolver
1.1.1.1,8.8.8.8,… -retry
number
- Brute force DNS records using a placeholder:
dnsx -domain
FUZZ.example.com -wordlist
path/to/wordlist.txt -re
- Brute force DNS records from a list of [d]omains and wordlists, appending [o]utput to a file with [n]o [c]olor codes:
dnsx -domain
path/to/domain.txt -wordlist
path/to/wordlist.txt -re -output
path/to/output.txt -no-color
- Extract
CNAME
records for the given list of subdomains, with [r]ate [l]imiting DNS queries per second:
subfinder -silent -d
example.com | dnsx -cname -re -rl
number