# dnscan: Scan Domains for DNS Subdomains This repository profile is provided by osrepos.com, an open source repository discovery platform. Source: osrepos.com Repository profile: https://osrepos.com/repo/rbsec-dnscan Generated for open source discovery and AI-assisted research. dnscan is a Python wordlist-based DNS subdomain scanner. It first attempts DNS zone transfers, then can discover names through recursive wordlist scans, with options for IPv6, alternate resolvers and TLD scanning. GitHub: https://github.com/rbsec/dnscan OSRepos URL: https://osrepos.com/repo/rbsec-dnscan ## Summary dnscan is a Python wordlist-based DNS subdomain scanner. It first attempts DNS zone transfers, then can discover names through recursive wordlist scans, with options for IPv6, alternate resolvers and TLD scanning. ## Topics - python - cli - networking - security-tools - dns-enumeration - subdomain-scanner ## Repository Information Last analyzed by OSRepos: Mon Oct 26 2026 16:19:24 GMT+0000 (Western European Standard Time) Detail views: 2 GitHub clicks: 0 ## Safety Notice OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything. ## Content ## Overview dnscan is a Python wordlist-based DNS subdomain scanner for discovering DNS names associated with a target domain. It first attempts a zone transfer from the domain's nameservers; if that fails, it looks up TXT and MX records and scans using a supplied or included wordlist. It is aimed at security practitioners and administrators who need a command-line way to enumerate subdomains or check domain presence across TLDs. Scans can target one domain or a newline-separated list, and discovered names can be written to files. ## Key Features - Attempts zone transfers against each target domain's nameservers. - Scans subdomains using included or custom wordlists, with configurable threading. - Supports recursive scanning, depth limits, and optional wildcard recursion. - Offers alteration scans that add prefixes and suffixes to candidate names. - Can check IPv6 records and use a specified DNS resolver or resolver list. - Provides TLD scanning with included TLD and suffix lists. - Writes scan results and discovered IP addresses to separate output files. ## Use Cases - Security practitioners can enumerate subdomains during an authorized assessment, using wordlists and recursion to expand discovery. - DNS administrators can check whether zone transfers are available and inspect the names exposed by them. - Teams maintaining multiple domains can run a batch scan from a newline-separated domain file. - Researchers can use the included TLD lists to check which TLDs contain a given base domain. ## Our Take dnscan is a focused command-line DNS enumeration tool, but its inactive maintenance status and highly concentrated contributions make long-term support uncertain. **Good fit if:** - You need a Python CLI for zone-transfer attempts and wordlist-based DNS subdomain discovery. - You can work with Python 3 and install the required `netaddr` and `dnspython` libraries. - GPL-3.0 fits your distribution and usage requirements. **Look elsewhere if:** - You need a project with recent commits, releases, or demonstrated recent issue and pull request handling. - Your team requires ongoing maintenance from a broadly shared contributor base. - Your workflow needs features beyond DNS enumeration, such as a documented service interface or web application. ## Project Health | Signal | Value | |---|---| | Status | **Inactive**: no commits in over a year | | Last commit | 2024-12-17 (1.9 years ago) | | Commits, last 90 days | 0 | | Releases, last 12 months | 0 | | Contributors | 10 (top contributor: 89% of commits) | | Issues closed, last 90 days | 0 | | Pull requests merged, last 90 days | 0 | | Project age | 13 years | Checked on 2026-10-26 with the GitHub API. ## Project Facts - Language: Python - License: GPL-3.0 - Stars: 1.3k - Forks: 409 - Archived: no ## What You Need Detected in the repository: - Python (from requirements.txt) - A Dockerfile, so it can run in a container ## Getting Started Install the dependencies, then run the script with a domain: ```sh pip install -r requirements.txt python3 dnscan.py -d example.org ``` See the [README](https://github.com/rbsec/dnscan#readme) for options, wordlist details, and additional examples. ## License in Plain Words **GPL-3.0** (strong copyleft). - Commercial use: yes - Modify and redistribute: yes - You must keep: the license notice - Share your changes: yes, the full source of anything you distribute that includes it, under the GPL - Includes an explicit patent grant from the contributors A summary, not legal advice: the LICENSE file is what applies. ## Alternatives - [subwiz](https://osrepos.com/repo/hadriansecurity-subwiz): subwiz predicts subdomains with a transformer and verifies them by DNS resolution, while dnscan discovers names through wordlist scans and attempts zone transfers. - [CloakQuest3r](https://osrepos.com/repo/spyboy-productions-cloakquest3r): CloakQuest3r combines subdomain scanning with historical IP and certificate analysis to find exposed origins, while dnscan focuses on DNS enumeration. | Project | Language | License | Stars | Status | |---|---|---|---|---| | **dnscan** | Python | GPL-3.0 | 1.3k | Inactive | | [subwiz](https://osrepos.com/repo/hadriansecurity-subwiz) | Python | MIT | 389 | Active | | [CloakQuest3r](https://osrepos.com/repo/spyboy-productions-cloakquest3r) | Python | MIT | 2.3k | Quiet | ## Considerations The repository is marked inactive, with no commits in over a year and no releases in the past year. Most of the code comes from one person, and there has been no recent issue closure or pull request merging, so adopters should plan for limited maintenance. The tool requires Python 3 plus `netaddr` and `dnspython`; alteration scans create many extra permutations and can be slow. GPL-3.0 terms may also affect how the software can be incorporated or redistributed.