How do I install the Dnsx skill?

Run npx skillmds@latest add aeondave/dnsx in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Dnsx skill do?

Auth/lab ref: Fast DNS resolution and brute-force tool from ProjectDiscovery. It is listed under Coding & Dev Tools on SkillMD.

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dnsx?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

AeonDave (@aeondave) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dnsx by aeondave — Agent Skill

Name: Dnsx
Author: AeonDave

File contents

dnsx

Fast DNS toolkit — resolve, brute-force, and extract DNS records at scale.

Quick Start

# Resolve a list of subdomains
cat subs.txt | dnsx

# DNS brute-force against a domain
dnsx -d example.com -w wordlist.txt

# Extract A records with response
cat subs.txt | dnsx -a -resp

Core Flags

Flag	Description
`-l <file>`	Input list of hosts/subdomains
`-d <domain>`	Target domain (for brute-force)
`-w <wordlist>`	Wordlist for brute-force
`-a`	Query A records
`-aaaa`	Query AAAA records
`-cname`	Query CNAME records
`-mx`	Query MX records
`-ns`	Query NS records
`-txt`	Query TXT records
`-ptr`	Query PTR records
`-resp`	Show DNS response
`-resp-only`	Show DNS response only
`-rcode <code>`	Filter by rcode (e.g., `noerror,nxdomain`)
`-r <resolvers>`	Custom resolver file
`-rl <n>`	Rate limit (requests/second)
`-t <n>`	Threads (default 100)
`-timeout <n>`	Timeout (default 5s)
`-silent`	Print results only
`-o <file>`	Output file
`-json`	JSON output
`-wildcard`	Filter wildcard subdomains
`-cdn`	Show CDN name for resolved IPs
`-asn`	Show ASN info for resolved IPs
`-recon`	Query all record types at once
`-wt <n>`	Wildcard threshold (default 5)
`-retry <n>`	Retry failed queries

Common Workflows

# Pipeline: subfinder -> dnsx resolution
subfinder -d target.com -silent | dnsx -silent

# DNS brute-force with wordlist
dnsx -d target.com -w /usr/share/dnsrecon/subdomains-top1mil-5000.txt -t 50

# Get all record types in JSON
cat subs.txt | dnsx -a -cname -mx -txt -resp -o dns_records.json -json

# Resolve IPs for a list
cat domains.txt | dnsx -a -resp-only | sort -u

# Filter wildcard results
cat subs.txt | dnsx -wildcard -d target.com -silent

# Reverse DNS (PTR) on IPs
cat ips.txt | dnsx -ptr -resp-only

# Full recon pipeline: subfinder -> dnsx -> httpx
subfinder -d target.com -silent -all | \
  dnsx -silent -a -resp-only | \
  httpx -silent -status-code -title -tech-detect

# Extract MX/TXT for email security audit
dnsx -d target.com -mx -txt -resp -silent

# Brute-force with custom resolvers (bypass rate limits)
dnsx -d target.com -w subdomains.txt -r resolvers.txt -rl 500

# Wildcard detection + filter
dnsx -d target.com -w wordlist.txt -wildcard -wt 3 -silent

# Extract CNAMEs (find dangling/takeovers)
cat subs.txt | dnsx -cname -resp -silent | grep -v "target.com"

Resources

File	When to load
`references/dns-records.md`	DNS record types, brute-force wordlists, wildcard detection, subdomain takeover

---name: dnsxdescription: Auth/lab ref: Fast DNS resolution and brute-force tool from ProjectDiscovery.license: MIT---# dnsxFast DNS toolkit — resolve, brute-force, and extract DNS records at scale.## Quick Start```bash# Resolve a list of subdomainscat subs.txt | dnsx# DNS brute-force against a domaindnsx -d example.com -w wordlist.txt# Extract A records with responsecat subs.txt | dnsx -a -resp```## Core Flags| Flag | Description ||------|-------------|| `-l <file>` | Input list of hosts/subdomains || `-d <domain>` | Target domain (for brute-force) || `-w <wordlist>` | Wordlist for brute-force || `-a` | Query A records || `-aaaa` | Query AAAA records || `-cname` | Query CNAME records || `-mx` | Query MX records || `-ns` | Query NS records || `-txt` | Query TXT records || `-ptr` | Query PTR records || `-resp` | Show DNS response || `-resp-only` | Show DNS response only || `-rcode <code>` | Filter by rcode (e.g., `noerror,nxdomain`) || `-r <resolvers>` | Custom resolver file || `-rl <n>` | Rate limit (requests/second) || `-t <n>` | Threads (default 100) || `-timeout <n>` | Timeout (default 5s) || `-silent` | Print results only || `-o <file>` | Output file || `-json` | JSON output || `-wildcard` | Filter wildcard subdomains || `-cdn` | Show CDN name for resolved IPs || `-asn` | Show ASN info for resolved IPs || `-recon` | Query all record types at once || `-wt <n>` | Wildcard threshold (default 5) || `-retry <n>` | Retry failed queries |## Common Workflows```bash# Pipeline: subfinder -> dnsx resolutionsubfinder -d target.com -silent | dnsx -silent# DNS brute-force with wordlistdnsx -d target.com -w /usr/share/dnsrecon/subdomains-top1mil-5000.txt -t 50# Get all record types in JSONcat subs.txt | dnsx -a -cname -mx -txt -resp -o dns_records.json -json# Resolve IPs for a listcat domains.txt | dnsx -a -resp-only | sort -u# Filter wildcard resultscat subs.txt | dnsx -wildcard -d target.com -silent# Reverse DNS (PTR) on IPscat ips.txt | dnsx -ptr -resp-only# Full recon pipeline: subfinder -> dnsx -> httpxsubfinder -d target.com -silent -all | \ dnsx -silent -a -resp-only | \ httpx -silent -status-code -title -tech-detect# Extract MX/TXT for email security auditdnsx -d target.com -mx -txt -resp -silent# Brute-force with custom resolvers (bypass rate limits)dnsx -d target.com -w subdomains.txt -r resolvers.txt -rl 500# Wildcard detection + filterdnsx -d target.com -w wordlist.txt -wildcard -wt 3 -silent# Extract CNAMEs (find dangling/takeovers)cat subs.txt | dnsx -cname -resp -silent | grep -v "target.com"```## Resources| File | When to load ||------|--------------|| `references/dns-records.md` | DNS record types, brute-force wordlists, wildcard detection, subdomain takeover |

Frequently asked questions

Dnsx