Skip to content

DNSX

Purpose

DNSX resolves domains and subdomains to IP assets and enriches IP assets with PTR records using ProjectDiscovery dnsx.

Plugin Information

Plugin ID: dnsx

Category: Resolution

Plugin Type: resolver

Execution: CLI DNS resolution

Default State: enabled

Default Profiles:

  • quick
  • default
  • deep
  • recon_nmap
  • tls_audit
  • web_discovery
  • port_discovery
  • recon_expanded
  • screenshot

Input Scope

Accepted asset types:

  • domain
  • subdomain
  • ip

Required metadata:

  • None

Produces targets:

  • Newline-delimited hostnames/IPs on stdin.

Output

Creates assets:

  • domain or subdomain host assets when DNSX output contains A/AAAA/CNAME/NS/MX records for the host.
  • ip

Creates vulnerabilities:

  • None

May enrich:

  • IP assets with source hostname metadata.
  • IP assets with PTR observed state when DNSX output contains PTR records for an IP target.

Metadata:

  • IP metadata record_type: A or AAAA when available.
  • domain: hostname from DNSX output.
  • source: dnsx.

Canonical observed state:

  • Host asset metadata.asset_info.dns.a.
  • Host asset metadata.asset_info.dns.aaaa.
  • Host asset metadata.asset_info.dns.cname.
  • Host asset metadata.asset_info.dns.ns.
  • Host asset metadata.asset_info.dns.mx.
  • IP asset metadata.asset_info.network.ptr.

Observed DNS record sets use replace_set per record type. An A-record observation replaces only dns.a; it does not remove dns.aaaa, dns.cname, dns.ns, dns.mx, or IP network.ptr. Omitted record types are not interpreted as removals.

Graph Relations

No explicit resolves_to edge is currently created by the worker. The emitted IP assets feed port and service discovery.

Files / Artifacts

Produces:

  • None

Dependencies

Required binary: dnsx

Required installer entry: tools.dnsx

Command model:

dnsx -json -silent -a -aaaa -cname -ns -mx -ptr

Example Flow

subdomain
  -> dnsx
ip

Notes

JSON output is preferred. The parser also accepts a plain text fallback with at least host ip fields for A-record compatibility. DNSX does not populate WHOIS/RDAP or ASN observed state.