DEV Community

Abhinav Singwal
Abhinav Singwal

Posted on

Mastering dnsx: Essential Commands for Fast and Reliable DNS Resolution

#dnsx #dnsxtool #dnsxcommands #cybersecuritytool

dnsx is a fast, multi-purpose DNS toolkit from ProjectDiscovery designed for security professionals who need to resolve, filter, and enumerate DNS records at scale. While tools like Gobuster and Amass handle discovery, dnsx specializes in what comes next: taking a list of candidate hostnames and determining which ones actually resolve, what records they return, and whether they are worth further investigation. This guide covers twenty practical dnsx commands, explaining what each does and when to reach for it during reconnaissance and enumeration workflows.

Top 10 Commands dnsx

1. Basic DNS Resolution 

dnsx -l subdomains.txt
Enter fullscreen mode Exit fullscreen mode

The -l flag reads a list of subdomains or hostnames from a file or standard input. By default, dnsx queries the A record for each entry and returns the hostnames that resolve. This is the foundational command for filtering passive discovery results down to live hosts .

2. Resolve from Standard Input 

cat subdomains.txt | dnsx -silent
Enter fullscreen mode Exit fullscreen mode

The -silent flag suppresses the banner and progress indicators, showing only results. Piping from standard input is the most common pattern in recon pipelines, allowing dnsx to sit between discovery tools like subfinder and probing tools like httpx .

3. Display A Records with Responses 

dnsx -l subdomains.txt -a -resp
Enter fullscreen mode Exit fullscreen mode

The -a flag explicitly queries A records, and -resp displays each hostname alongside its DNS response. This shows the actual IP addresses, which helps identify shared hosting, cloud providers, and potential infrastructure relationships .

4. Display Only DNS Responses 

dnsx -l subdomains.txt -resp-only
Enter fullscreen mode Exit fullscreen mode

The -resp-only flag emits only the DNS response values without the hostname prefix. This is useful when feeding IP addresses into subsequent tools or when you need a clean list of resolved addresses .

5. Query CNAME Records 

dnsx -l subdomains.txt -cname -resp
Enter fullscreen mode Exit fullscreen mode

The -cname flag queries CNAME records instead of the default A records. CNAMEs reveal cloud services, CDNs, and third-party integrations. A dangling CNAME pointing to an unclaimed cloud resource is a subdomain takeover candidate .

6. Query Multiple Record Types 

dnsx -l subdomains.txt -a -cname -mx -ns -txt
Enter fullscreen mode Exit fullscreen mode

dnsx supports querying multiple record types in a single pass. Combining A, CNAME, MX, NS, and TXT records gives a complete picture of a domain's DNS configuration without running separate commands .

7. Query All Records in Recon Mode 

dnsx -l subdomains.txt -recon
Enter fullscreen mode Exit fullscreen mode

The -recon flag queries every DNS record type supported by dnsx in one pass. This includes A, AAAA, CNAME, NS, TXT, SRV, PTR, MX, SOA, AXFR, and CAA. It is the most comprehensive single-command option for DNS enumeration .

8. Brute Force Subdomains 

dnsx -d example.com -w wordlist.txt
Enter fullscreen mode Exit fullscreen mode

The -d flag specifies the target domain, and -w provides a wordlist of subdomain prefixes. dnsx generates candidate hostnames and resolves them in one pass. This is faster and more integrated than piping brute-force output from a separate tool .

9. Brute Force with Custom Resolvers 

dnsx -d example.com -w wordlist.txt -r resolvers.txt
Enter fullscreen mode Exit fullscreen mode

The -r flag specifies a list of custom DNS resolvers. Public resolvers, internal corporate resolvers, or trusted high-speed resolvers can be supplied to improve accuracy and speed. The default resolvers are Google, Cloudflare, and Quad9 .

10. Control Thread Count 

dnsx -l subdomains.txt -t 50
Enter fullscreen mode Exit fullscreen mode

The -t flag sets the number of concurrent threads. The default is 100. Lowering this reduces load on resolvers and avoids rate limiting. Raising it speeds up resolution on large lists when the resolver infrastructure can handle the traffic .

11. Rate Limit Requests 

dnsx -l subdomains.txt -rl 100
Enter fullscreen mode Exit fullscreen mode

The -rl flag sets the maximum number of DNS requests per second. This is essential when resolving against rate-limited resolvers or when the target organization monitors for DNS enumeration traffic. The default is no rate limit .

12. Filter by DNS Status Code 

dnsx -l subdomains.txt -rcode noerror
Enter fullscreen mode Exit fullscreen mode

The -rcode flag filters results by DNS response code. Common values include noerror (successful resolution), servfail, and refused. Filtering for noerror removes hosts that fail to resolve cleanly .

13. Filter Wildcard DNS Noise 

dnsx -l subdomains.txt -wd example.com
Enter fullscreen mode Exit fullscreen mode

The -wd flag enables wildcard filtering for the specified domain. Wildcard DNS records resolve any subdomain to the same IP, producing false positives that flood results. Wildcard filtering eliminates these entries, leaving only genuine resolutions .

14. Adjust Wildcard Filter Threshold 

dnsx -l subdomains.txt -wd example.com -wt 10
Enter fullscreen mode Exit fullscreen mode

The -wt flag sets the wildcard filter threshold. dnsx considers a domain wildcarded when more than the threshold number of subdomains resolve to the same address. The default is 5. Increasing this makes wildcard detection more conservative .

15. Display ASN Information 

dnsx -l subdomains.txt -asn
Enter fullscreen mode Exit fullscreen mode

The -asn flag displays Autonomous System Number information for resolved hosts. ASN data helps identify which network the target infrastructure belongs to, revealing shared hosting, cloud providers, and potential BGP relationships .

16. Display CDN Name 

dnsx -l subdomains.txt -cdn
Enter fullscreen mode Exit fullscreen mode

The -cdn flag annotates results with the CDN provider name when a host is served through a content delivery network. This is useful for excluding CDN-fronted hosts from further testing or for identifying third-party dependencies .

17. Write Output in JSON Format 

dnsx -l subdomains.txt -json -o results.json
Enter fullscreen mode Exit fullscreen mode

The -json flag writes output in JSON Lines format, and -o specifies the output file. JSON output integrates cleanly with parsing tools, dashboards, and automated pipelines that consume structured data .

18. Query PTR Records for Reverse Lookups 

dnsx -l ip_addresses.txt -ptr -resp
Enter fullscreen mode Exit fullscreen mode

The -ptr flag performs reverse DNS lookups on a list of IP addresses. This reveals hostnames associated with IP ranges and helps map an organization's network landscape from discovered IPs .

19. Query TXT Records for Reconnaissance 

dnsx -l subdomains.txt -txt -resp
Enter fullscreen mode Exit fullscreen mode

The -txt flag queries TXT records, which often contain valuable reconnaissance data including SPF records, domain verification tokens, and sometimes sensitive configuration details. TXT records can reveal third-party services and internal infrastructure .

20. Resume an Interrupted Scan 

dnsx -l subdomains.txt -resume
Enter fullscreen mode Exit fullscreen mode

The -resume flag restarts a previously interrupted scan. dnsx saves progress automatically. This is essential for long-running brute-force or resolution tasks on large lists that may be interrupted by network issues or system restarts .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top comments (0)