# How to Use SecLists for Subdomain Enumeration: A Complete Guide to DNS Wordlists

> Master subdomain enumeration with SecLists DNS wordlists. Discover subdomains efficiently using tools like massdns and amass. Explore comprehensive lists for rapid reconnaissance.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: how-to-guide
- Published: 2026-03-03

---

**SecLists provides curated DNS wordlists in `Discovery/DNS/` that you feed into brute-force tools like massdns, dnsx, or amass to discover subdomains, with [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) serving as the comprehensive master list and smaller top-N lists for rapid reconnaissance.**

SecLists is the industry-standard repository of wordlists for security testing. For subdomain enumeration, the collection located in `Discovery/DNS/` offers specialized lists derived from real-world DNS data, enabling you to efficiently brute-force or resolve potential subdomain candidates against your target domains.

## Understanding the SecLists DNS Wordlist Structure

The DNS discovery wordlists in danielmiessler/SecLists are organized by scope and data source within the `Discovery/DNS/` directory. According to the repository's [`Discovery/DNS/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/README.md), these lists originate from a Cloudflare zone-transfer dataset and other public sources.

### The Combined Master List

The [`Discovery/DNS/combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/combined_subdomains.txt) file merges the most popular public subdomain sources—including Bitquark, Shubs, and the Cloudflare-derived top-1 million list—into a single comprehensive wordlist. This file contains over 150,000 unique entries after deduplication, making it the default choice for thorough enumeration campaigns.

### Top-N Lists by Size

For scenarios requiring speed over coverage, the repository provides truncated versions of the Cloudflare data:

- [`subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-5000.txt) – First 5,000 entries for quick sanity checks
- [`subdomains-top1million-20000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-20000.txt) – 20,000 entries for balanced reconnaissance  
- [`subdomains-top1million-110000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-110000.txt) – 110,000 entries for deep scans without the full dataset weight

### Language-Specific Collections

Beyond the English-centric top lists, SecLists includes regional variants such as [`subdomains-spanish.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-spanish.txt) and [`subdomains-italian.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-italian.txt). These target non-English environments where locale-specific naming conventions increase discovery probability.

## Selecting the Right SecLists Wordlist for Your Scope

Your choice of wordlist should align with engagement constraints and target characteristics:

- **Quick sanity check on a small target**: Use [`subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-5000.txt). The 5,000-entry footprint completes in minutes, ideal for fast confirmation of subdomain takeover vulnerabilities or initial footprinting.

- **Full-scale enterprise enumeration**: Deploy [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt). The merged, deduplicated dataset (~150,000+ entries) maximizes coverage without the redundancy of running multiple separate lists.

- **Language-targeted scope**: Select [`subdomains-spanish.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-spanish.txt) (or equivalent) when assessing regional subsidiaries or non-English infrastructure where localized terms appear in hostnames.

- **Reducing false positives**: Pair [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) with a filter list or whitelist. The comprehensive nature of the combined list, when processed through tools like `dnsrecon` with verification, improves accuracy by weeding out wildcard DNS responses.

## Practical Subdomain Enumeration with SecLists

Integrate these wordlists into your toolchain using either local file paths (after cloning the repository) or raw GitHub URLs for tools that support remote wordlist fetching.

### High-Speed Brute-Forcing with massdns

The `massdns` resolver performs high-speed DNS resolution using local resolvers. Clone SecLists locally, then reference the path directly:

```bash
git clone https://github.com/danielmiessler/SecLists.git /opt/SecLists
massdns -r /usr/local/etc/resolvers.txt -t A -q -w results.txt \
  /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

```

Process the results to extract valid subdomains:

```bash
cat results.txt | grep " CNAME\| A " | awk '{print $1}' | sort -u

```

### Efficient DNS Resolution with dnsx

ProjectDiscovery's `dnsx` supports direct URL input for wordlists, making it ideal for quick one-off commands without cloning:

```bash
dnsx -l https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/combined_subdomains.txt \
     -silent -resp -retry 2 -o valid_subdomains.txt

```

### Integrated Reconnaissance with amass

OWASP Amass can ingest SecLists wordlists to augment its passive and active discovery engines. Use the combined list to add depth beyond Amass's built-in sources:

```bash
amass enum -d example.com \
  -w /opt/SecLists/Discovery/DNS/combined_subdomains.txt \
  -o amass_subdomains.txt

```

### Classic Enumeration with sublist3r

For legacy workflows or specific brute-force modes, Sublist3r accepts the SecLists wordlist via the `-w` flag:

```bash
sublist3r -d example.com \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt \
  -o sublist3r_output.txt

```

## Summary

- SecLists hosts specialized subdomain wordlists in `Discovery/DNS/`, including the comprehensive [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) and size-tiered top-N lists.
- The [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) file aggregates Bitquark, Shubs, and Cloudflare-derived sources for maximum coverage.
- Select [`subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-5000.txt) for rapid 5,000-entry scans or regional lists like [`subdomains-spanish.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-spanish.txt) for locale-specific targeting.
- Feed these lists into massdns, dnsx, amass, or sublist3r via local paths or raw GitHub URLs to execute brute-force and resolution-based enumeration.

## Frequently Asked Questions

### What is the difference between combined_subdomains.txt and the top1million lists?

The [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) file merges multiple public sources (Bitquark, Shubs, and Cloudflare data) into a single deduplicated master list containing over 150,000 entries. The `subdomains-top1million-*.txt` files are subsets derived specifically from a Cloudflare zone-transfer dump, segmented by volume (5,000, 20,000, 110,000) to provide smaller, faster alternatives for time-constrained testing.

### Which SecLists wordlist should I use for a quick penetration test?

For time-boxed engagements or quick sanity checks, use [`Discovery/DNS/subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/subdomains-top1million-5000.txt). Its small size allows massdns or dnsx to complete resolution within minutes while still covering the statistically most common subdomain patterns.

### How were the SecLists DNS wordlists generated?

According to [`Discovery/DNS/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/README.md), the top-1 million lists were generated from a Cloudflare zone-transfer dataset dated January 2026, filtering for subdomains that appeared at least twice in the dataset to reduce noise. The combined list incorporates additional curated sources to expand coverage beyond the Cloudflare dataset alone.

### Can I use these wordlists with tools other than massdns?

Yes. The SecLists DNS wordlists are plain-text files compatible with any subdomain enumeration tool that accepts wordlist input, including dnsx, amass, sublist3r, dnsrecon, and gobuster. Simply specify the file path or URL via the tool's respective wordlist flag (e.g., `-w` for amass and sublist3r, `-l` for dnsx).