Please describe your feature request:

-spf to extract ip's from spf records (includes,redirects,...)

• Reference : https://github.com/darkoperator/dnsrecon/blob/e1b742ea92c9e123d807601322748911d92cf727/dnsrecon.py#L99

Describe the use case of this feature:

echo gmail.com | dnsx -spf -json

"spf_ip4": [
"35.190.247.0/24",
"64.233.160.0/19",
"66.102.0.0/20",
"66.249.80.0/20",
"72.14.192.0/18",
"74.125.0.0/16",
...,
]

Is your feature request related to a problem? Please describe.
Upon querying A record, we can get all details including recursive CNAMEs, but it misses recursive CNAMEs when only querying for cname.

Current behavior with a and cname:-

echo resources.hackerone.com | ./dnsx -a -cname -resp -silent

resources.hackerone.com [52.60.160.16]
resources.hackerone.com [52.60.165.183]
resources.hackerone.com [read.uberflip.com]
resources.hackerone.com [nlb-ext-traefik-ca-central-1-d39d611502919b07.elb.ca-central-1.amazonaws.com]

Current behavior with cname query:-

echo resources.hackerone.com | ./dnsx -cname -resp -silent

resources.hackerone.com [read.uberflip.com]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Expected behavior with cname query:-

echo resources.hackerone.com | ./dnsx -cname -resp -silent

resources.hackerone.com [read.uberflip.com]
resources.hackerone.com [nlb-ext-traefik-ca-central-1-d39d611502919b07.elb.ca-central-1.amazonaws.com]

dnsx version:

v1.0.7

Current Behavior:

echo servers-3.redacted.com | dnsx -raw

      _             __  __
   __| | _ __   ___ \ \/ /
  / _' || '_ \ / __| \  / 
 | (_| || | | |\__ \ /  \ 
  \__,_||_| |_||___//_/\_\ v1.0.7

		projectdiscovery.io

Use with caution. You are responsible for your actions
Developers assume no liability and are not responsible for any misuse or damage.
;; opcode: QUERY, status: NOERROR, id: 39784
;; flags: qr tc rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;servers-3.redacted.com.	IN	 A

;; ADDITIONAL SECTION:

;; OPT PSEUDOSECTION:
; EDNS: version 0; flags: ; udp: 1232

Expected Behavior:

dnsx able to get same response as we can see with dig

dig servers-3.redacted.com

; <<>> DiG 9.10.6 <<>> servers-3.redacted.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48345
;; flags: qr rd ra; QUERY: 1, ANSWER: 100, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;servers-3.redacted.com.	IN	A

;; ANSWER SECTION:
servers-3.redacted.com. 1000 IN	A	XX.195.34.62
servers-3.redacted.com. 1000 IN	A	XX.209.147.183
servers-3.redacted.com. 1000 IN	A	XX.79.183.243
servers-3.redacted.com. 1000 IN	A	XX.73.102.177
servers-3.redacted.com. 1000 IN	A	XX.198.144.19
servers-3.redacted.com. 1000 IN	A	XX.252.78.202
servers-3.redacted.com. 1000 IN	A	XX.201.24.140
servers-3.redacted.com. 1000 IN	A	XX.84.239.89
servers-3.redacted.com. 1000 IN	A	XX.155.56.184
servers-3.redacted.com. 1000 IN	A	XX.79.205.174
servers-3.redacted.com. 1000 IN	A	XX.216.150.10
servers-3.redacted.com. 1000 IN	A	XX.60.196.174
servers-3.redacted.com. 1000 IN	A	XX.39.239.9
servers-3.redacted.com. 1000 IN	A	XX.72.171.28
servers-3.redacted.com. 1000 IN	A	XX.186.248.248
servers-3.redacted.com. 1000 IN	A	XX.188.209.27
servers-3.redacted.com. 1000 IN	A	XX.189.119.61
servers-3.redacted.com. 1000 IN	A	XX.157.216.165
servers-3.redacted.com. 1000 IN	A	XX.95.185.26
servers-3.redacted.com. 1000 IN	A	XX.83.243.179
servers-3.redacted.com. 1000 IN	A	XX.86.29.101
servers-3.redacted.com. 1000 IN	A	XX.220.97.248
servers-3.redacted.com. 1000 IN	A	XX.78.210.218
servers-3.redacted.com. 1000 IN	A	XX.190.95.218
servers-3.redacted.com. 1000 IN	A	XX.75.167.62
servers-3.redacted.com. 1000 IN	A	XX.197.250.8
servers-3.redacted.com. 1000 IN	A	XX.224.102.9
servers-3.redacted.com. 1000 IN	A	XX.200.209.15
servers-3.redacted.com. 1000 IN	A	XX.197.121.63
servers-3.redacted.com. 1000 IN	A	XX.90.249.70
servers-3.redacted.com. 1000 IN	A	XX.171.108.153
servers-3.redacted.com. 1000 IN	A	XX.39.127.94
servers-3.redacted.com. 1000 IN	A	XX.80.57.66
servers-3.redacted.com. 1000 IN	A	XX.35.161.96
servers-3.redacted.com. 1000 IN	A	XX.60.144.72
servers-3.redacted.com. 1000 IN	A	XX.165.158.227
servers-3.redacted.com. 1000 IN	A	XX.207.33.92
servers-3.redacted.com. 1000 IN	A	XX.170.101.10

Steps To Reproduce:

echo servers-3.redacted.com | dnsx

      _             __  __
   __| | _ __   ___ \ \/ /
  / _' || '_ \ / __| \  / 
 | (_| || | | |\__ \ /  \ 
  \__,_||_| |_||___//_/\_\ v1.0.7

		projectdiscovery.io

Use with caution. You are responsible for your actions
Developers assume no liability and are not responsible for any misuse or damage.

reach out to me over discord/slack to get an example host for testing.

Describe the bug
With the release of v1.0.2, dnsx doesn't output invalid DNS response with json or raw flag and only returns a response for valid response NOERROR, related issue #13

Dnsx version
v1.0.3

To replicate this:-

With dnsx v1.0.1

echo aaaaaa.hackerone.com -silent | ./dnsx -silent  -json | jq -j '.host, ":", .status_code, "\n"'

aaaaaa.hackerone.com -silent:NXDOMAIN

With dnsx v1.0.3

echo aaaaaa.hackerone.com -silent | ./dnsx -silent  -json | jq -j '.host, ":", .status_code, "\n"'

Notice, dnsx doesn't report invalid status code anymore.

Proposed solution:-

Adding invalid DNS response as default is also costly in terms of running large scans and saving as JSON output, so it should optional and as default, the current behavior is the expected one.

New flag addition to adding additional DNS responses:-

Flag:-
rcode

• DNS Response code

Example:-
dnsx -rcode 0,2,5

RCODE0 - NOERROR
RCODE1 - FORMERR
RCODE2 - SERVFAIL
RCODE3 - NXDOMAIN
RCODE4 - NOTIMP
RCODE5 - REFUSED
RCODE6 - YXDOMAIN
RCODE7 - XRRSET
RCODE8 - NOTAUTH
RCODE9 - NOTZONE

More about RCODE - https://support.umbrella.com/hc/en-us/articles/232254248-Common-DNS-return-codes-for-any-DNS-service-and-Umbrella-

Is your feature request related to a problem? Please describe.

Hey Team! - It would be cool if we could choose to include specific responses in our output besides NOERROR and valid domains such as NXDOMAIN, SERVFAIL, REFUSED etc.

This may be a weird suggestion as dnsx's main purpose is to find valid live resolving domains but sometimes there is a need to find which domains are in the above states, mainly SERVFAIL.

~ @m0chan

Currently dnsx has retry limit set to 1 which results in inconsistent results :

Setting the retry limit to 2 by default will give better results each time.

Is there a better solution for wildcard domain detection? This detection usually filters out some genuine resolutions

Blocked by projectdiscovery/retryabledns#36

Hello,

I really like this tool, especially since it is crazy fast and it does exactly what I want :D That being said, I usually have the need to remove hostnames from a list, for instance those who do not resolve to any IPv4 address. I know that I can do dnsx -a -cname to print only domains with a A or CNAME record but I wish I could have only domain who:

• have an A record
• have at least one CNAME that itself has an A record

It might be a little out of the scope of the tool's purpose but if such a thing is either planned or in current development, I'd like to hear more about it :)

As this title
I wanna know that when can we use dnsx as project subfinder's EnumerateSingleDomain method in our project?maybe i'm too anxious

Already Implemented in ebd2a77

Previously JSON output contains raw DNS query output for all hosts and for some its unwanted additional data increasing the size of JSON output for large scans.

With this update, it becomes optional and DNS query output will be added when raw flag is used along with json flag.

Hi,

for some reason when i run mapcidr -cidr 173.0.84.0/24 -silent | dnsx -silent -resp-only -ptr,my terminal becomes unresponsive, tried on 6 different linux machines with 30gb memory, I am unable to provide more data on this since I have no idea whats a happening.
I need to run "reset" every time i run dnsx

thanks

Describe the bug
If I provide DNSX a list of fifteen domains (five that return NXDOMAIN, five that return SERVFAIL, and five that return NOERROR) I can only get NOERROR and NXDOMAIN responses from DNSX. No matter what command I run DNSX will not return domains with a SERVFAIL response.

Dnsx version
v1.0.5

Screenshot of the error or bug
Using this list of ten domains:

acevivo.com
92acheter.com
93acidtestdjs.com
94ackplumbing.com
95acorntalent.com
24hrsinside.com
25dprinting.com
24x7life.com
269photo.com
2befreetoday.com
billbullington.com
billymacrae.com
bildung-online.com
billyvancreamy.com
bim4m2.com

Running

dnsx -rcode NOERROR,NXDOMAIN -l test.txt

Returns

92acheter.com [NXDOMAIN]
93acidtestdjs.com [NXDOMAIN]
95acorntalent.com [NXDOMAIN]
269photo.com [NOERROR]
25dprinting.com [NOERROR]
24hrsinside.com [NOERROR]
24x7life.com [NOERROR]
2befreetoday.com [NOERROR]
94ackplumbing.com [NXDOMAIN]
acevivo.com [NOERROR]

However, running

dnsx -rcode 0,1,2,3,4,5 -l test.txt

or

dnsx -rcode NOERROR,NXDOMAIN,SERVFAIL,REFUSED -l test.txt

Still only returns NOERROR and NXDOMAIN responses:

92acheter.com [NXDOMAIN]
93acidtestdjs.com [NXDOMAIN]
95acorntalent.com [NXDOMAIN]
269photo.com [NOERROR]
25dprinting.com [NOERROR]
24hrsinside.com [NOERROR]
24x7life.com [NOERROR]
2befreetoday.com [NOERROR]
94ackplumbing.com [NXDOMAIN]
acevivo.com [NOERROR]

After some testing, i noticed that -retry actually behaves like a -num-tries option.

Indeed, running dnsx with -retry 0, we should exepct it to try once, then dont REtry at all.
If the int defines the total number of tries, it should then be renamed into -tries or -num-tries to avoid confusion.
Otherwise the helper should be a bit more specific.

Describe the bug
installing bug:

go get -v github.com/projectdiscovery/dnsx/cmd/dnsx
github.com/projectdiscovery/hmap/store/disk

github.com/projectdiscovery/hmap/store/disk

/root/go/src/github.com/projectdiscovery/hmap/store/disk/badger.go:22:15: badgerOptions.EventLogging undefined (type badger.Options has no field or method EventLogging)

Dnsx version
Please share the version of the dnsx you are running with dnsx -version

Screenshot of the error or bug

Describe the bug
When using the -wd option for dnsx, no output is given, even if the domains are not wildcards. For example...
cat yahoo.txt | dnsx -wd yahoo.com

Thousands of subdomains being sent through, but no domains returned. I've tried playing with different -wt values, but no luck there. I get plenty of results when not using the -wd flag though. I have also tried with multiple domain lists.

DNSX version
Please share the version of the nuclei you are running with dnsx -version
1.0.1

Screenshot of the error or bug
N/A. No error.

👋 FYI, Since dnsprobe is deprecated in favor of this utility, I have filed a PR to include this into homebrew-core. Thanks!

Describe the bug
dnsx has some issue or has no support for EDNS record. As you can see from dig command ; EDNS: version: 0, flags:; udp: 1232 which mean that EDNS record are being used and DNS message length is over 512 bytes.

Dnsx version
v1.0.5

Screenshot of the error or bug

• dig command for poc.melbadry9.xyz

• dnsx command for poc.melbadry9.xyz

Please describe your feature request:

Currently, domain/d flag accept single or comma-separated multiple domain input, this support can be extended to accept file input containing a list of domains per line, similar to the wordlist and resolver flag.

Describe the use case of this feature:

will allow to brute-forcing list of domains

Please describe your feature request:

#137 (comment)
Would be great if you could choose the wordlist placeholder like ffuf

Describe the use case of this feature:

cat list.txt | ffuf -u http://127.0.0.1/FUZZ -w - 

cat tldlist.txt | dnsx  -d "google.FUZZ" -w - 

cat tldlist.txt | dnsx  -d "DOMAINS.FUZZ" -w -:FUZZ  -w domains.txt:DOMAINS

Is your feature request related to a problem? Please describe.
Feature X can be broken while adding feature Y and go unnoticed.

Describe the solution you'd like

Functional test implementation similar to nuclei to run pre-defined testcases.txt to compare results between current branch and last released version.

Describe the bug
Option -txt doesn't provide any results on some domains where dig is. It's working on some other domains like projectdiscovery.io or google.com.

I tried on a Kali VM to make sure it was not related to docker. I have the same issue.

dnsx version
1.0.1

Screenshot of the error or bug

Not sure if that would cause other issues but I think an option to combine results for a record type would be nice.

Before

echo hackerone.com | dnsx -a -silent -resp
hackerone.com [104.16.100.52]
hackerone.com [104.16.99.52]

After

echo hackerone.com | dnsx -a -silent -resp
hackerone.com [104.16.100.52, 104.16.99.52]

Please describe your feature request:

Currently, list input supports stdin as default, with addition wordlist based DNS brute-forcing, we can extend this support for other input flags as well, including domain and wordlist.

Flag for stdin can be indicated with a specific marker(-) with validation to ensure only one flag is getting used for stdin

$ cat subs.txt | dnsx  # as default, stdin is used for list flag
$ cat words.txt | dnsx -d google.com,youtube.com -w - # wordlist flag with stdin support
$ echo jira,confluence | dnsx -d domains.txt -w - # wordlist flag with stdin support
$ echo google.com,youtube.com | dnsx -w words.txt -d - # domain flag with stdin support

$ echo google.com,youtube.com | dnsx -w - -d - # validation for multiple stdin
multiple flags with stdin can not be specified

Describe the use case of this feature:

to ease automation around dnsx

Hi, when I run dnsx on same list I get inconsistent output. I have tested it on my VPS at digitalocean.
dnsx version is 1.0.6 but it was behaving same at 1.0.1 version before I updated it.

Speedtest result of VPS:

Is your feature request related to a problem? Please describe.
For providing CIDR as input, we need to use mapCIDR as an additional tool.

Describe the solution you'd like

Like httpx, naabu, we can utilize the mapCIDR library to support CIDR as input for dnsx.

Please describe your feature request:

Add a -dname flag to allow DNAME record queries.

Describe the use case of this feature:

DNAME records hold a tree of subdomains, which can be useful information.

For some reason, bruteforce module attempts to resolve input root domain and later word combinations, however resovling input domain is not expected.

dnsx version:

dev

Steps To Reproduce:

$ cat root.txt

hackerone.com
google.com
twitter.com

dnsx -silent -d root.txt -w www

Current Behavior:

dnsx -silent -d root.txt -w www

hackerone.com
twitter.com
google.com
www.hackerone.com
www.twitter.com
www.google.com

Expected Behavior:

dnsx -silent -d root.txt -w www

www.hackerone.com
www.twitter.com
www.google.com

Fixed at #106

Goflags comes with the following support:

• Auto-generated flag configuration file
• Long / Short formatted flag support
• Help menu grouping support

Please describe your feature request:

Boolean field to include in the default JSON output to indicate if resolved IP is internal or not, ranges of internal IP can be obtained from https://datatracker.ietf.org/doc/html/rfc5735

echo google.com | dnsx -json

{
  "host": "google.com",
  "resolver": [
    "8.8.8.8:53"
  ],
  "a": [
    "142.250.192.14"
  ],
  "status_code": "NOERROR",
+  "internal": false
  "timestamp": "2022-01-13T13:06:43.081861+05:30"
}

echo dmyx.com | dnsx -json

{
  "host": "dmyx.com",
  "resolver": [
    "8.8.8.8:53"
  ],
  "a": [
    "127.0.0.1"
  ],
  "status_code": "NOERROR",
+  "internal": true
  "timestamp": "2022-01-13T13:56:10.324053+05:30"
}

Requested by breno_css#8797

Hey there!

I'd like to report a security issue but cannot find contact instructions on your repository.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Please describe your feature request:

1. list flag can not be used with domain or wordlist flag.

$ dnsx -l list.txt -d hackerone.com
$ dnsx -l list.txt -w words.txt
$ dnsx -l list.txt -w words.txt -d hackerone.com

list flag can not be used domain or wordlist flag

2. domain and wordlist flag can not be used alone / they have to be used together.

$ dnsx -d hackerone.com

missing wordlist flag required with domain input

$ dnsx -w words.txt

missing domain flag required with wordlist input

Describe the use case of this feature:

• will avoid confusion between uses of DNS resolution and brute force
• will suggest the required flag to use.

Describe the bug
An error within one of the query types causes a global fail

Describe the bug
-stats flag does not enable the stats bar.

dnsx version
[INF] Current Version: 1.0.1

Reported by
mightocho on discord.

dnsx version

v1.0.3

CMD to replicate:-

echo hackerone.com | dnsx -silent -r 109.228.25.186,158.43.128.72,194.187.251.67,37.152.45.194,188.227.240.58,158.43.240.4,212.118.241.33,88.208.211.65,88.208.229.248,109.228.14.101,162.13.11.127,88.208.218.166,178.62.57.141,5.253.114.91,154.32.107.18,154.32.109.18,158.43.192.1,158.43.240.3,8.8.8.8

Crash details

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x18 pc=0x102a09588]

goroutine 1 [running]:
github.com/projectdiscovery/dnsx/internal/runner.fileExists(0x16d6bb9b6, 0x106, 0x0)
	/Users/ehsandeep/go/pkg/mod/github.com/projectdiscovery/[email protected]/internal/runner/util.go:17 +0x88
github.com/projectdiscovery/dnsx/internal/runner.New(0x1400015e3f0, 0x300000002, 0x14000121f28, 0x10274a8a8)
	/Users/ehsandeep/go/pkg/mod/github.com/projectdiscovery/[email protected]/internal/runner/runner.go:42 +0x80
main.main()
	/Users/ehsandeep/go/pkg/mod/github.com/projectdiscovery/[email protected]/cmd/dnsx/dnsx.go:12 +0x24

Is your feature request related to a problem? Please describe.
Add stop/resume support

Is your feature request related to a problem? Please describe.
Currently, it is expected that resolvers running DNS service on port 53 as default which is true but having an option to define host:port in the input will allow cases server running DNS service on non 53 ports.

Describe the solution you'd like
Supporting host:port format in the resolver input list, if no port is specified in the input, 53 will default to use.

Is your feature request related to a problem? Please describe.

echo walmart.com | dnsx -silent -ns -resp-only

Pdnswm1.ultradns.net
Pdnswm2.ultradns.net
Pdnswm3.ultradns.org
Pdnswm4.ultradns.org
Pdnswm5.ultradns.info
Pdnswm6.ultradns.co.uk
a1-185.akam.net
a10-66.akam.net
a22-67.akam.net
a3-64.akam.net
a5-65.akam.net
a8-66.akam.net

Describe the solution you'd like
A clear and concise description of what you want to happen.

echo walmart.com | dnsx -silent -ns -resp-only

pdnswm1.ultradns.net
pdnswm2.ultradns.net
pdnswm3.ultradns.org
pdnswm4.ultradns.org
pdnswm5.ultradns.info
pdnswm6.ultradns.co.uk
a1-185.akam.net
a10-66.akam.net
a22-67.akam.net
a3-64.akam.net
a5-65.akam.net
a8-66.akam.net

• Address #10
• Allowing more options to tune the wildcard filtering
• Research and implement improved filter algorithms

Please describe your feature request:

Porting allow/deny support from httpx to dnsx

Describe the use case of this feature:

allows us to define which hosts to be passed through or denied for processing.