PAGES
← all tools
◆ Reconnaissance & OSINT

dnsmap

0.30 open-source

dnsmap scans a domain for common subdomains using a built-in or an external wordlist, mainly used by pentesters during the information gathering phase.

source ↗ rss ↗ What is a cyber toolchain?

Summary

dnsmap is an open-source command-line tool that scans a domain for subdomains by brute-forcing a built-in or external wordlist, matching around 1000 common names like ns1, smtp, or firewall against the target. It runs without root privileges and writes results to CSV or human-readable output for later processing. It is aimed at penetration testers doing information gathering during infrastructure assessments, particularly useful when zone transfers are blocked, as they usually are. It sits in the DNS enumeration corner of reconnaissance tooling, alongside other subdomain brute-forcers rather than a named competitor. First committed in 2019 and maintained as a revival of a 2006 project, it now has 5 contributors but has seen no commits in the past year, so treat it as stable rather than actively developed.

dnsmap scans a domain for common subdomains using a built-in or an external wordlist, mainly used by pentesters during the information gathering phase.

How dnsmap helps

Which subdomains actually exist for a target domain when zone transfers are refused?

works through a list of roughly 1000 common names in English and Spanish against the domain and reports every one that resolves, giving you a subdomain map without relying on the DNS server handing over its zone

What forgotten or badly configured hosts is a target organization exposing?

flags names like test or staging that resolve successfully, surfacing servers that were likely never meant to be found through normal browsing

Which internal IP ranges is a domain leaking through its DNS answers?

checks resolved addresses against the RFC 1918 private ranges and reports any subdomain that discloses an internal IP

Am I about to be misled by a domain that resolves everything I throw at it?

attempts to detect wildcard DNS configurations before the brute-force run, so matches from a wildcard-enabled domain can be recognized as false positives rather than real hosts

Which new remote-access or extranet entry points does this organization have that aren't listed anywhere public?

surfaces subdomains such as extranet or vpn-style names that resolve but were never linked from the main site, giving a starting point for further netblock and whois research

Can I hand these results to another tool or report without retyping them?

writes matches to CSV or a human-readable file, timestamped automatically if no output name is given, so the list of found hosts can be reused downstream

Languages

Not documented

Release-note detail over time

See how much detail dnsmap puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

2 entries

  1. February 20101
  3. February 20091

    2 entries

    1. 0.30 Feb 20, 2010 · release notes

      dnsmap 0.30 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, new CLI flags for delaying and ignoring IPs, wildcard bruteforce, and TLA subdomains.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.30 https://github.com/resurrecting-open-source-projects/dnsmap.git
# already have the repo? check out this version:
$ git checkout 0.30
      • Adds -d delay flag and -i ignore-IPs flag to control scanning behavior
      • Adds IPv6 network support for DNS enumeration
      • Adds mechanism to attempt to bruteforce wildcard-enabled domains
      • Adds standalone three-letter acronym (TLA) subdomains wordlist alongside updated built-in wordlist
      • Adds reporting of disclosed internal IP addresses (RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic.)
      +3 more show less
      • Adds reporting for domains susceptible to same site scripting
      • Adds completion time display and unique timestamped default output filename
      • Adds Makefile included for building dnsmap

      8 details in Everything

    2. 0.22 Feb 22, 2009 · release notes

      dnsmap 0.22 adds CSV output and bulk domain scanning via included bash script

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.22 https://github.com/resurrecting-open-source-projects/dnsmap.git
# already have the repo? check out this version:
$ git checkout 0.22
      • Adds --csv output format option to save results in CSV for easy processing
      • Includes new dnsmap-bulk.sh bash script to run dnsmap against multiple domains from a file

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in resurrecting-open-source-projects/dnsmap, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 3 of 6 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 3
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 48
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback