PAGES
← all tools
◆ Reconnaissance & OSINT

massdns

v1.1.0 open-source

High-performance DNS stub resolver that resolves millions of domain names rapidly using publicly available resolvers.

Summary

massdns is an open-source DNS stub resolver that resolves domain names in bulk, capable of over 350,000 resolutions per second against public resolvers without special tuning. It is a command-line tool, built from source with make and driven through options for record type, resolver list, concurrency and output format, so it fits into scripted pipelines rather than running as a service. It suits people doing large-scale subdomain enumeration and passive recon, such as resolving brute-forced subdomain lists or names pulled from certificate transparency logs, rather than one-off lookups. Development has slowed: first committed in 2016 with 28 contributors over its life, but only one commit in the past year and its last release was over two years ago.

High-performance DNS stub resolver that resolves millions of domain names rapidly using publicly available resolvers.

How massdns helps

Which of the millions of names in my brute-force wordlist actually resolve?

feeds the domain list through concurrent lookups against a resolver list and writes only the names that got an answer, at rates over 350,000 resolutions per second

Which subdomains pulled from certificate transparency logs are actually live?

resolves the extracted names in bulk the same way as any other input list, turning a passive-recon dump into a set of confirmed hosts

What DNS records exist for a huge list of names beyond just their IPv4 address?

accepts multiple record type queries per run so a single pass can pull A, AAAA, MX, NS or TXT records instead of one lookup per type

Which of my resolvers are slow or unreliable under load?

lets concurrency be tuned up or down, so runs against a custom resolver list expose which resolvers hold up and which cause overload or congestion

Can I recover the reverse-DNS names for a whole IPv4 range?

runs PTR queries across the address list in bulk and reports back the names attached to each one

Which names in a target's zone respond to non-recursive queries, hinting at cache contents?

supports issuing non-recursive queries, useful for probing what a nameserver's cache already holds rather than forcing a fresh lookup

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities · 4 backed by code, an API document or a real run

Built from massdns's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • massdns covers 1 of the 13 network discovery and scanning capabilities we track.

What massdns offers you

  • Command-line interface2
  • JSON data export1
All capabilities 5 capabilities
Subdomain enumeration via DNS resolution verified Resolves subdomains of a target domain against a wordlist, querying configurable DNS record types through user-supplied resolvers to enumerate valid subdomains. 2 releases · 12 other sources · first seen Oct 2021

Shared capability: Attack surface inventory

release

  • Add query support for SVCB and HTTPS DNS record types v1.1.0 · Mar 2024 · source · release history
  • Adds --ignore and --filter options to filter DNS responses by status codes v1.0.0 · Oct 2021 · source · release history

docs

  • High-performance DNS stub resolver that resolves millions of domain names rapidly using publicly available resolvers.

command line

  • domain — Domain for certificate search. v1.1.0 · Mar 2024 · command-line history
  • -t — The DNS record type to be queried for. When this option is not present, the default value is "A". This option can be specified multiple times to query for multiple record types. Record types you may want to query include, but are not limited to, A, AAAA, MX, NS, TXT. v1.1.0 · Mar 2024 · command-line history
  • subdomain_file — Subdomain file to append to. v1.1.0 · Mar 2024 · command-line history

example 8 total

  • Query SVCB and HTTPS records and output clean TXT values in ndjson format for downstream parsing. massdns -r resolvers.txt -t SVCB,HTTPS --output j domains.txt v1.1.0 · Mar 2024 · source
  • Filter results to only include successful queries (RCODE=0) while ignoring SERVFAIL responses. massdns -r resolvers.txt -t A domains.txt --filter 0 --ignore 2 v1.0.0 · Oct 2021 · source
  • Brute-force subdomains for a domain ./scripts/subbrute.py example.com lists/names.txt | ./bin/massdns -r lists/resolvers.txt -t A -o S -w results.txt
  • Resolve AAAA records, write to file ./bin/massdns -r lists/resolvers.txt -t AAAA -w results.txt domains.txt
  • Resolve all IPv4 PTR records ./scripts/ptr.py | ./bin/massdns -r lists/resolvers.txt -t PTR -w ptr.txt
  • Resolve all AAAA records from domain list ./bin/massdns -r lists/resolvers.txt -t AAAA domains.txt > results.txt
Output file writing verified Writes enumeration results to a specified file instead of stdout. 2 releases · 2 other sources · first seen Mar 2020

Also counts toward: Command-line interface, JSON data export

release

  • Add --ndjson output mode with corrected TXT record quoting (quotes are stripped from the value) v1.1.0 · Mar 2024 · source · release history
  • Adds NDJSON as a supported output format for results. v0.3 · Mar 2020 · source · release history

command line

  • -w — Instead of writing results to stdout, write them to the file specified by this option. v1.1.0 · Mar 2024 · command-line history

example

  • Pipe MassDNS results into a JSON line processor. massdns -r resolvers.txt -t A -o J domains.txt v0.3 · Mar 2020 · source
Concurrent lookup rate control verified Allows the user to set the number of concurrent DNS lookups to balance throughput against resolver and network load. 1 other source · first seen Mar 2024

command line

  • -s — This option accepts an integer that controls the number of concurrent lookups and thus the lookup rate. When being too low, the available network performance is not exhausted. When being too high, it may overload resolvers or cause network congestion. v1.1.0 · Mar 2024 · command-line history
Custom resolver configuration verified Accepts a file of IPv4 or IPv6 resolver addresses, with optional port specification, to control which nameservers are used during lookups. 1 other source · first seen Mar 2024

Also counts toward: Command-line interface

command line

  • -r — File containing the list of resolvers/nameservers to be used. Each line should contain an IPv4 or IPv6 address. Specifying ports (using a colon, together with square brackets in case of IPv6 addresses) is optional. By default, DNS port 53 will be used. v1.1.0 · Mar 2024 · command-line history
Per-domain resolver association shipped Allows specifying dedicated resolvers directly within the target domains file alongside domain names. 1 release · first seen Mar 2024

release

  • Add dedicated resolver support: list resolvers/nameservers directly in the domains file alongside target domains v1.1.0 · Mar 2024 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for massdns, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail massdns puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

3 entries

  1. March 20241
  2. October 20211
  3. March 20201

    3 entries

    Project health

    Issue, contributor and maintainer activity in blechschmidt/massdns, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −2 vs prior 12 months
    2. Maintainers 0 +0 joined · −1 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 28 days first maintainer reply 28 days
    6. Open backlog 13 of 110 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 13
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 3,645
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →