massdns(1)

📦 version 1.1.0, in nixos 26.05, nixpkgs unstable

🌸 NAME 🌸

okay so welcome to massdns(1) bestie 💖 — this is the manual for massdns, the high-performance DNS stub resolver for bulk lookups and reconnaissance. It is literally built for researchers doing internet measurements and for bug bounty hunters leveraging it for subdomain enumeration during their reconnaissance process. slay ✨

🦋 SYNOPSIS 🦋

massdns [options] -r resolvers.txt domains.txt

💅 DESCRIPTION 💅

So massdns is a high-performance DNS stub resolver. It is targeting researchers performing internet measurements and bug bounty hunters leveraging it for subdomain enumeration during their reconnaissance process. Because it is a stub resolver, massdns relies on third-party resolvers to perform recursive lookups. No cap.

massdns is written in C and does not make use of threads. Instead, it uses epoll on Linux to handle communication concurrently. The number of concurrent lookups is user-controlled. All DNS requests are made using UDP. periodt. 💜

🎀 COMMAND-LINE OPTIONS 🎀

massdns currently does not follow POSIX convention recommendations. All command line arguments and their values have to be separated by spaces. iykyk ✨

  • -b, --bindto — IP addresses for massdns query sockets. When this option is not specified, massdns will bind to 0.0.0.0:0, causing the operating system to pick an appropriate IP address and port. If this option is specified multiple times, a query socket for each address is created. When sending a query, a socket is then selected at random. 🎀
  • --busy-poll — Instead of using epoll, massdns will make use of busy-waiting. This is a non-configurable default on non-Linux platforms, where epoll is not available. This is not very efficient, so you should refrain from using this option in most cases. fr fr, be careful with this one. 💀
  • -c, --resolve-count — This value is an integer that specifies how often massdns attempts to resolve a name. A failure reason can either be due to a timeout (as specified by -i) or an unacceptable response code (as specified by --retry). For reliable resolvers and when an appropriate concurrency value is set, this value can be quite low. The default value is 50, which is very high. 😭
  • --drop-user — This option is only relevant when you run the program as root, which is not recommended for security reasons. In this case, privileges will be dropped to the specified user. If this option is not specified, this will be the nobody user if it exists on the system. If --drop-group is not specified, the group will be set to the main group of the specified user, which is nogroup for nobody. security bestie behavior. 🫶
  • --drop-group — When being run as root, set the group to this value instead of the main group of the user specified by --drop-user. 👑
  • --extended-input — By default, massdns treats each input line as a query. When this option is specified, a line will be treated as a query separated from resolver addresses by a space. Instead of example.com, an input line can then be example.com 1.1.1.1 8.8.8.8:53, causing the program to attempt to resolve example.com via 1.1.1.1 and 8.8.8.8 before falling back to the resolver list. Port specification is optional. By default, DNS port 53 is used. this one is lowkey iconic for recon. 🦋
  • --filter — This option defines a DNS response code whitelist of packets to be printed. It can be specified multiple times. For example, --filter NXDOMAIN --filter REFUSED will only print packets with the specified codes. DNS response codes can either be specified textually or numerically. This option and --ignore are mutually exclusive. 💅
  • --flush — This option causes the output stream to be flushed whenever a response was written. ✨
  • --help — Shows a help text that is more compressed than this man page. ngl, this page is the full vibe. 😌
  • --ignore — In contrast to --filter, this option defines a blacklist. 🙈
  • -i, --interval — This option specifies a timeout in milliseconds to wait between multiple resolves of the same domain. The default value is 500. ⏳
  • -l, --error-log — Instead of logging to /dev/stderr, log to the specified file. This is useful because the status output can be quite noisy and cause errors to be overlooked when printed to stderr as well. save your eyes, bestie. 😭
  • --norecurse — DNS has a flag called RD, which is short for “Recursion Desired”. By default, massdns assumes that you want to use it with recursive resolvers, so it will set this bit. Sometimes, for example when performing DNS cache snooping, you may want to unset this bit. You may also want to unset this bit when performing subdomain enumeration against authoritative nameservers. 🌈
  • -o, --output — This option specifies the output format. The first character specifies the general output class, such as whether to output JSON, human-readable full-text or binary data. The following characters specify advanced output flags that are specific to this output class.

The following output classes are supported:

  • L — list output — Only output the query names of response packets, i.e. effectively only output domains. 📝

Advanced output flags:

  • 0 — By default, the list output mode will only output query names of packets that have at least one answer record. When this flag is enabled, the list output will also output NOERROR packets without answers. This is particularly useful for performing subdomain enumeration against some nameservers, where a NOERROR code might give away that another record type than the queried one exists for the DNS name. big subdomain-enum energy. 🔥
  • S — simple text output — Due to the multitude of advanced flags that have accumulated over time, the “simple text output” has become less simple. It now supports many flags that allow for an advanced customization of the output. Really, you should probably use JSON instead. By default, this output mode outputs all resource records of the DNS answer section that match the question name. Each record will be on a separate line. If any advanced output flag has been specified, this output mode will also print resource records that do not match the question name, unless specified otherwise by the advanced output flag m.

Advanced output flags:

  • d — Include records from the additional section. As the simple text output outputs records from the answer section by default, enabling this flag will only output records from the additional section, unless the output of records from other sections is explicitly turned on. 🧚
  • i — Indent resource records with a tab. This is especially useful when the DNS question is printed. ✨
  • m — Only output resource records that match the question name. 🎯
  • n — Include records from the answer section. This option works analogously to the d option. 💫
  • q — Instead of only outputting resource records, also output the DNS question. ❓
  • r — Print the question with resolver IP address, Unix timestamp and response code prepended. This flag implies the q flag. 🕰️
  • s — Print an additional newline character after each DNS packet. 🌸
  • t — Include TTL and record class within the output. 🎀
  • u — Include records from the authority section. This option works analogously to the d option. 👑
  • F — full text output — This output mode is not customizable and outputs all successful responses in the style of the dig tool. 🔍
  • F — binary output — The uncustomizable binary format has no binding specification but follows from the source code. The repository includes a dnsparse.py script that is kept up to date with the binary format as output by massdns. 💾
  • J — NDJSON (new-line delimited JSON) — This output causes each response packet to be printed as a JSON object. 🧾

Advanced output flags:

  • e — Instead of only writing JSON objects for successful resolves, also write a record for each terminal failure, such as a final timeout or a final unacceptable response code. terminal failure but make it JSON. 💀

Note that not all record types are supported. Only the binary output mode allows you to preserve the content of all records as it writes raw DNS packets to the output stream. The following record types are currently supported in non-binary output modes: A, AAAA, CAA, CNAME, DNAME, MX, NS, SRV, PTR, SOA, TXT. write that down bestie. 🍓

  • --predictable — By default, the resolver for a query will be picked randomly for each transmission. If this option is specified, the resolver will be picked in a deterministic, predictable manner. The first query will use the first resolver from the list, the second query will use the second one and so on (modulo the number of resolvers). This can be leveraged to conduct resolver tests. 🧪
  • --processes — In case resolving with a single process is not fast enough, you can use more than one process. This option specifies the number of processes to be used, so the default value is 1. When multiple processes are used, -w needs to be specified. massdns will then fork and write the output of each process to a different file, following a shared-nothing approach. more processes, more chaos, more slay. 🔥
  • --quiet — When this option is specified, massdns will not print progress stats and it will not display some warnings. 🤫
  • --rand-src-ipv6 — When this option is supplied with an IPv6 subnet in CIDR notation, massdns will use a raw UDP socket for IPv6 resolvers. For each query, a random IP address from the subnet is used. This allows to bypass rate limits for some public IPv6 resolvers. It will only work if your machine is provided with a routed prefix and can use addresses from within its subnet without neighbor discovery. IPv6 girlies rise. 🌈
  • --rcvbuf — Size of the receive buffer of the query socket(s) in bytes. 📦
  • -r, --resolvers — File containing the list of resolvers/nameservers to be used. Each line should contain an IPv4 or IPv6 address. Specifying ports (using a colon, together with square brackets in case of IPv6 addresses) is optional. By default, DNS port 53 will be used. 🫶
  • --retry — okay so this is the “what counts as a fail and gets another shot” knob. You give it the DNS response codes that are considered a failure and cause a lookup to be retried. By default, massdns retries lookups for all responses without NOERROR or NXDOMAIN response code. The second you specify this option, it behaves as a whitelist for retries. Why is that useful? Because some resolvers will return codes such as REFUSED or SERVFAIL once you hit internal rate limits, and when you’re doing subdomain enumeration you do not want to miss responses in this case, so they are retried automatically. This option accepts DNS response codes in textual or numeric format. It also supports the special value never, which instructs massdns to never consider any valid DNS response to be unacceptable. That would be a reasonable setting when working with reliable, trusted resolvers. 💅
  • --root — do not drop the privileges when running as root. For security reasons, using this option is not recommended. 🫣
  • -s, --hashmap-size — this option accepts an integer that controls the number of concurrent lookups and thus the lookup rate. Too low? Then the available network performance is not exhausted. Too high? It may overload resolvers or cause network congestion. Internally, massdns makes use of a hash map which stores information about ongoing lookups, so this option defines the number of ongoing lookups. When all slots of the hash map are occupied, the next lookup will take place as soon as one lookup times out (as specified by --i) or returns an unacceptable response (as specified by --retry). The value of this option is directly correlated with the number of successful lookups per second. Consider a single, non-rate-limiting name server with an average RTT of ca. 10ms. A value of 1 for this option can then already reach about 100 successful lookups per second. The default value of this option is 10,000. This option supports the special value auto, which aims to adjust the concurrency automatically. At the moment, the auto feature doubles the number of concurrent lookups until timeouts are observed. Thus, this feature is experimental and useful only when all resolvers are 100 % reliable, e.g. in case they are authoritative. ⚡
  • --sndbuf — size of the send buffer of the query socket(s) in bytes. 🎀
  • --status-fmt — this option can be either json or ansi. When it is not specified, it defaults to ansi, causing massdns to print out stats in human-readable format to stderr. In case you want to automate the use of massdns, you may want to use json to parse the output. ✨
  • --sticky — without this option, each lookup (including its retries) will pick a resolver at random. With this option, retries will stick to the same resolver. 🧚
  • --socket-count — if --bindto has not been specified, this option controls the number of query sockets to use per IP version. 🌸
  • -t, --type — the DNS record type to be queried for. When this option is not present, the default value is A. This option can be specified multiple times to query for multiple record types. Record types you may want to query include, but are not limited to, A, AAAA, MX, NS, TXT. 👑
  • --verify-ip — by default, massdns will not verify incoming IP addresses. This option enables source IP verification of incoming packets. 🔥
  • -w, --outfile — instead of writing results to stdout, write them to the file specified by this option. 🍓

🌐 WEBSITE 🌐

https://github.com/blechschmidt/massdns

That’s a wrap, bestie — this page is for massdns 1.0.0, dated 2021, and the manual page is massdns(1). Mwah 💋✨

📦 where this page comes from