Massdns

MassDNS

High-speed DNS bulk resolver — resolve millions of subdomains per minute.

Quick Start

git clone https://github.com/blechschmidt/massdns
cd massdns && make

# Resolve subdomain list
./bin/massdns -r resolvers.txt -t A subdomains.txt -o S -w resolved.txt

# Built-in resolver list
./bin/massdns -r lists/resolvers.txt -t A subdomains.txt -o S > resolved.txt

Core Flags

Output Formats

Common Workflows

Subdomain enumeration pipeline:

# Generate candidates with subfinder
subfinder -d target.com -silent -o subs.txt

# Resolve with massdns
./bin/massdns -r lists/resolvers.txt -t A subs.txt -o S | grep -v NXDOMAIN > live.txt

Extract live IPs:

cat resolved.txt | grep " A " | awk '{print $3}' | sort -u > ips.txt

DNS brute-force (generate + resolve):

# Generate permutations with puredns or subfinder, then resolve at scale
subfinder -d target.com -silent -all | \
  massdns -r lists/resolvers.txt -t A -o S 2>/dev/null | \
  grep -v "NXDOMAIN\|SERVFAIL" > resolved.txt

CNAME hunting for subdomain takeover:

massdns -r lists/resolvers.txt -t CNAME subs.txt -o J 2>/dev/null | \
  jq -r 'select(.answers[0].type=="CNAME") | "\(.name) \(.answers[0].data)"' | \
  grep -v "target\.com"

MX record enumeration:

massdns -r lists/resolvers.txt -t MX domains.txt -o S 2>/dev/null | \
  grep " MX " | sort -u

Wildcard detection:

# Check if domain has wildcard DNS
python3 scripts/wildcard.py target.com lists/resolvers.txt
# massdns includes wildcard detection scripts in scripts/

Rate-limited run (avoid resolver bans):

massdns -r lists/resolvers.txt -t A subs.txt -o S -s 100 --resolvers-rnd 2>/dev/null

Resources