dnsx (ProjectDiscovery)

What it is

A Go command-line program that runs many DNS queries in parallel against resolvers you supply. It returns A, AAAA, CNAME, MX, TXT, PTR and other records and can print only the hosts that actually resolve.

What it helps with

- Checking which discovered subdomains are live
- Pulling specific record types across large host lists
- Spotting wildcard DNS so false hits are filtered out
- Bruteforcing subdomains from a wordlist

Who it's for

Pentesters, bug bounty hunters, and recon teams working on domains they own or are authorized to assess.

Worth knowing

It reads from standard input and writes plain or JSON lines, so it fits into shell pipelines. Using your own trusted resolver list makes results faster and more reliable.

Where does it fit in a recon workflow?
In our view it sits between Subfinder, which finds subdomain names, and httpx or Naabu, which probe the hosts that resolve.

Can it run reverse lookups?
Yes, it can take IP ranges and return PTR records for each address.