dnsx is a DNS client built for lists rather than single lookups. Feed it a file or a pipe of hostnames and it resolves them all concurrently, asking for A, AAAA, CNAME, NS, TXT, SRV, PTR, MX, SOA, CAA or AXFR records, and prints plain results or JSON with the response codes, TTLs, ASN and CDN detected. It can expand a wordlist against a domain, accepts custom resolvers over UDP, TCP, DNS over HTTPS and DNS over TLS, and has a wildcard filter that spots domains where every made-up subdomain resolves, so a list of a thousand names does not come back as a thousand false positives.
It is part of ProjectDiscovery's open-source toolkit alongside nuclei, httpx, subfinder and uncover, and it is usually the step that turns a raw list of names into the ones that are actually live. It is MIT-licensed and actively maintained, with about 2,900 stars, 37 contributors, a 1.3.1 release in August 2026 and a push the day before our scan. Binaries are on the releases page and in Homebrew.
- Repository: github.com/projectdiscovery/dnsx
- Licence: MIT (MIT License)
- Language: Go. Stars: 2,916. Forks: 327. Last push: Oct 27, 2026.
- Scan: safe, Oct 28, 2026, commit c72b42d
Who it is for
Sysadmins and DNS owners auditing what their zones actually return, security teams checking for dangling CNAMEs and stale records on their own domains, and researchers inside an authorised scope who need to resolve large host lists quickly.
Getting started
1. Install with Go 1.26.10 or later (or brew install dnsx; binaries are on the releases page)
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest2. Resolve a list of your own hostnames and show the answers
dnsx -l hosts.txt -resp3. Pull every common record type for one domain you own, as JSON
echo example.com | dnsx -recon -jsonBy default every query goes to Google, Cloudflare and Quad9's public resolvers; pass -r to use your own. Large lists or wordlists generate a lot of DNS traffic, which some VPNs throttle and some networks treat as abuse, so keep the rate sensible. Each run also checks api.pdtm.sh for a newer version, sending your OS, CPU architecture, Go version and a hashed machine ID; add -duc to turn that off.
Safety scan
We cloned projectdiscovery/dnsx at commit c72b42d on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits and no committed binaries across 53 files and about 4,800 lines of Go. The only network host in the scan is github.com. The two shell scripts it flags, cmd/functional-test/run.sh and integration_tests/run.sh, build the binary and run the test suites; neither uses sudo or downloads anything.
- go.mod has 12 known advisories, none critical and one high. The high one is in the s2 package of klauspost/compress; we built the dnsx command's dependency graph and s2 is not in it, only the zstd and Huffman parts are. The other 11 are unrated: HTTP/2 and HTML fixes in golang.org/x/net, two SSH denial-of-service fixes and the unmaintained openpgp package in golang.org/x/crypto, and a goldmark XSS issue in the update notes renderer.
- Eight workflows, none using pull_request_target. The 12 third-party action uses are pinned to tags rather than commits.
- Security policy, Dependabot, CodeQL and licence present; no contributing guide or code of conduct. OpenSSF Scorecard gives it 5.9, with full marks for maintenance and dangerous workflows.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 2 installer scripts |
| Committed binaries | None. |
| CI workflows | 8 workflows. None use pull_request_target. 12 of 12 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 1 distinct host referenced from source; most often github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 12 advisories across 104 pinned packages: 0 critical, 1 high, 0 moderate, 0 low, 11 unrated. go.mod: 104 packages, 12 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file. Missing contributing guide. |
| OpenSSF Scorecard | 5.9 out of 10, as of Oct 26, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (2)
- cmd/functional-test/run.sh, 24 lines
- integration_tests/run.sh, 22 lines
Worst known vulnerabilities (12 of 12)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-259r-337f-4rfw | high | github.com/klauspost/compress@1.18.2 | Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress |
| GHSA-c97m-vxhj-p7j6 | unknown | github.com/yuin/goldmark@1.7.4 | Cross-site Scripting (XSS) in github.com/yuin/goldmark |
| GO-2026-5932 | unknown | golang.org/x/crypto@0.55.0 | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues |
| CVE-2026-78662 | unknown | golang.org/x/crypto@0.55.0 | Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh |
| CVE-2026-56855 | unknown | golang.org/x/crypto@0.55.0 | Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh |
| CVE-2026-78659 | unknown | golang.org/x/net@0.58.0 | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-78660 | unknown | golang.org/x/net@0.58.0 | HTTP/2 transport accepts malformed framing-related headers in net/http |
| CVE-2026-78669 | unknown | golang.org/x/net@0.58.0 | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-78663 | unknown | golang.org/x/net@0.58.0 | Double flow control refund on HTTP/2 server streams in net/http |
| CVE-2026-97032 | unknown | golang.org/x/net@0.58.0 | HTTP/2 server crash due to HPACK encoder race in net/http |
| CVE-2026-78661 | unknown | golang.org/x/net@0.58.0 | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net |
| CVE-2026-97045 | unknown | golang.org/x/net@0.58.0 | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net |
By the numbers
| Stars | 2,916 |
|---|---|
| Forks | 327 |
| Contributors | 37 |
| Commits | 1,245 |
| Open issues | 1 |
| Open pull requests | 0 |
| Releases | 23 |
| Latest release | v1.3.1 |
| Licence | MIT |
| Main language | Go |
| Project age | 5 years |
| Last push | Oct 27, 2026 |
| Tracked files | 53 |
| Lines of code | 4,788 |
| Checkout size | 478 KB |
Lines by language: Go 3,755, Markdown 600, YAML 387, Shell 46.
Questions
Is dnsx free?
Yes. dnsx is MIT-licensed and free for any use, with no account or API key needed. It uses free public DNS resolvers by default, or any resolver you point it at.
Is it legal to use dnsx?
Resolving public DNS names is ordinary internet traffic, and dnsx only talks to DNS resolvers, not to the hosts it looks up. Brute-forcing subdomains or attempting zone transfers on someone else's domain can still breach a provider's terms or a bug bounty's rules, so use those features on domains you own or are authorised to test.
What is wildcard filtering in dnsx?
Some domains answer every possible subdomain, so random names resolve too. dnsx counts how many names point at the same IP, and when that passes a threshold it checks each level of the name for a wildcard and drops the matches. Use -auto-wildcard to detect them automatically, or -wd with a domain for manual filtering.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.