dnscan: Scan Domains for DNS Subdomains

Overview

dnscan is a Python wordlist-based DNS subdomain scanner for discovering DNS names associated with a target domain. It first attempts a zone transfer from the domain's nameservers; if that fails, it looks up TXT and MX records and scans using a supplied or included wordlist.

It is aimed at security practitioners and administrators who need a command-line way to enumerate subdomains or check domain presence across TLDs. Scans can target one domain or a newline-separated list, and discovered names can be written to files.

Key Features

• Attempts zone transfers against each target domain's nameservers.
• Scans subdomains using included or custom wordlists, with configurable threading.
• Supports recursive scanning, depth limits, and optional wildcard recursion.
• Offers alteration scans that add prefixes and suffixes to candidate names.
• Can check IPv6 records and use a specified DNS resolver or resolver list.
• Provides TLD scanning with included TLD and suffix lists.
• Writes scan results and discovered IP addresses to separate output files.

Use Cases

• Security practitioners can enumerate subdomains during an authorized assessment, using wordlists and recursion to expand discovery.
• DNS administrators can check whether zone transfers are available and inspect the names exposed by them.
• Teams maintaining multiple domains can run a batch scan from a newline-separated domain file.
• Researchers can use the included TLD lists to check which TLDs contain a given base domain.

Getting Started

Install the dependencies, then run the script with a domain:

pip install -r requirements.txt
python3 dnscan.py -d example.org

See the README for options, wordlist details, and additional examples.

Alternatives

• subwiz: subwiz predicts subdomains with a transformer and verifies them by DNS resolution, while dnscan discovers names through wordlist scans and attempts zone transfers.
• CloakQuest3r: CloakQuest3r combines subdomain scanning with historical IP and certificate analysis to find exposed origins, while dnscan focuses on DNS enumeration.

Considerations

The repository is marked inactive, with no commits in over a year and no releases in the past year. Most of the code comes from one person, and there has been no recent issue closure or pull request merging, so adopters should plan for limited maintenance. The tool requires Python 3 plus netaddr and dnspython; alteration scans create many extra permutations and can be slow. GPL-3.0 terms may also affect how the software can be incorporated or redistributed.