massdns

name	massdns
description	Auth/lab ref: High-performance DNS resolver for bulk subdomain resolution. For you have a large subdomain list and need to resolve all entries quickly using public resolvers.
license	MIT
compatibility	C; Linux/macOS; build from source.
metadata	{"author":"AeonDave","version":"1.1"}

MassDNS

High-speed DNS bulk resolver — resolve millions of subdomains per minute.

Quick Start

git clone https://github.com/blechschmidt/massdns
cd massdns && make

# Resolve subdomain list
./bin/massdns -r resolvers.txt -t A subdomains.txt -o S -w resolved.txt

# Built-in resolver list
./bin/massdns -r lists/resolvers.txt -t A subdomains.txt -o S > resolved.txt

Core Flags

Flag	Purpose
-r FILE	Resolver list file
-t TYPE	DNS type (A/AAAA/MX/NS/CNAME)
-o FORMAT	Output format (S=simple, J=JSON, L=list)
-w FILE	Write output to file
-s N	Concurrent resolvers (default: 500)
--root	Use root server for NS lookups
--verify-ip	Verify A record IPs
--flush	Flush DNS cache per request
-q	Quiet mode
--status-format <fmt>	Status line format
--retry N	Retry failed lookups
--resolvers-rnd	Shuffle resolver list

Output Formats

Flag	Format	Example Output
-o S	Simple (default)	sub.target.com. A 1.2.3.4
-o J	JSON	Full DNS response JSON
-o L	List	sub.target.com (only names)
-o F	Full	All DNS fields

Common Workflows

Subdomain enumeration pipeline:

# Generate candidates with subfinder
subfinder -d target.com -silent -o subs.txt

# Resolve with massdns
./bin/massdns -r lists/resolvers.txt -t A subs.txt -o S | grep -v NXDOMAIN > live.txt

Extract live IPs:

cat resolved.txt | grep " A " | awk '{print $3}' | sort -u > ips.txt

DNS brute-force (generate + resolve):

# Generate permutations with puredns or subfinder, then resolve at scale
subfinder -d target.com -silent -all | \
  massdns -r lists/resolvers.txt -t A -o S 2>/dev/null | \
  grep -v "NXDOMAIN\|SERVFAIL" > resolved.txt

CNAME hunting for subdomain takeover:

massdns -r lists/resolvers.txt -t CNAME subs.txt -o J 2>/dev/null | \
  jq -r 'select(.answers[0].type=="CNAME") | "\(.name) \(.answers[0].data)"' | \
  grep -v "target\.com"

MX record enumeration:

massdns -r lists/resolvers.txt -t MX domains.txt -o S 2>/dev/null | \
  grep " MX " | sort -u

Wildcard detection:

# Check if domain has wildcard DNS
python3 scripts/wildcard.py target.com lists/resolvers.txt
# massdns includes wildcard detection scripts in scripts/

Rate-limited run (avoid resolver bans):

massdns -r lists/resolvers.txt -t A subs.txt -o S -s 100 --resolvers-rnd 2>/dev/null

Resources

File	When to load
references/resolvers.md	Resolver list sources, rate tuning, wildcard handling, puredns integration