How to Use SecLists for Subdomain Enumeration: A Complete Guide to DNS Wordlists

SecLists provides curated DNS wordlists in Discovery/DNS/ that you feed into brute-force tools like massdns, dnsx, or amass to discover subdomains, with combined_subdomains.txt serving as the comprehensive master list and smaller top-N lists for rapid reconnaissance.

SecLists is the industry-standard repository of wordlists for security testing. For subdomain enumeration, the collection located in Discovery/DNS/ offers specialized lists derived from real-world DNS data, enabling you to efficiently brute-force or resolve potential subdomain candidates against your target domains.

Understanding the SecLists DNS Wordlist Structure

The DNS discovery wordlists in danielmiessler/SecLists are organized by scope and data source within the Discovery/DNS/ directory. According to the repository's Discovery/DNS/README.md, these lists originate from a Cloudflare zone-transfer dataset and other public sources.

The Combined Master List

The Discovery/DNS/combined_subdomains.txt file merges the most popular public subdomain sources—including Bitquark, Shubs, and the Cloudflare-derived top-1 million list—into a single comprehensive wordlist. This file contains over 150,000 unique entries after deduplication, making it the default choice for thorough enumeration campaigns.

Top-N Lists by Size

For scenarios requiring speed over coverage, the repository provides truncated versions of the Cloudflare data:

• subdomains-top1million-5000.txt – First 5,000 entries for quick sanity checks
• subdomains-top1million-20000.txt – 20,000 entries for balanced reconnaissance
• subdomains-top1million-110000.txt – 110,000 entries for deep scans without the full dataset weight

Language-Specific Collections

Beyond the English-centric top lists, SecLists includes regional variants such as subdomains-spanish.txt and subdomains-italian.txt. These target non-English environments where locale-specific naming conventions increase discovery probability.

Selecting the Right SecLists Wordlist for Your Scope

Your choice of wordlist should align with engagement constraints and target characteristics:

• Quick sanity check on a small target: Use subdomains-top1million-5000.txt. The 5,000-entry footprint completes in minutes, ideal for fast confirmation of subdomain takeover vulnerabilities or initial footprinting.

• Full-scale enterprise enumeration: Deploy combined_subdomains.txt. The merged, deduplicated dataset (~150,000+ entries) maximizes coverage without the redundancy of running multiple separate lists.

• Language-targeted scope: Select subdomains-spanish.txt (or equivalent) when assessing regional subsidiaries or non-English infrastructure where localized terms appear in hostnames.

• Reducing false positives: Pair combined_subdomains.txt with a filter list or whitelist. The comprehensive nature of the combined list, when processed through tools like dnsrecon with verification, improves accuracy by weeding out wildcard DNS responses.

Practical Subdomain Enumeration with SecLists

Integrate these wordlists into your toolchain using either local file paths (after cloning the repository) or raw GitHub URLs for tools that support remote wordlist fetching.

High-Speed Brute-Forcing with massdns

The massdns resolver performs high-speed DNS resolution using local resolvers. Clone SecLists locally, then reference the path directly:

git clone https://github.com/danielmiessler/SecLists.git /opt/SecLists
massdns -r /usr/local/etc/resolvers.txt -t A -q -w results.txt \
  /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

Process the results to extract valid subdomains:

cat results.txt | grep " CNAME\| A " | awk '{print $1}' | sort -u

Efficient DNS Resolution with dnsx

ProjectDiscovery's dnsx supports direct URL input for wordlists, making it ideal for quick one-off commands without cloning:

dnsx -l https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/combined_subdomains.txt \
     -silent -resp -retry 2 -o valid_subdomains.txt

Integrated Reconnaissance with amass

OWASP Amass can ingest SecLists wordlists to augment its passive and active discovery engines. Use the combined list to add depth beyond Amass's built-in sources:

amass enum -d example.com \
  -w /opt/SecLists/Discovery/DNS/combined_subdomains.txt \
  -o amass_subdomains.txt

Classic Enumeration with sublist3r

For legacy workflows or specific brute-force modes, Sublist3r accepts the SecLists wordlist via the -w flag:

sublist3r -d example.com \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt \
  -o sublist3r_output.txt

Summary

• SecLists hosts specialized subdomain wordlists in Discovery/DNS/, including the comprehensive combined_subdomains.txt and size-tiered top-N lists.
• The combined_subdomains.txt file aggregates Bitquark, Shubs, and Cloudflare-derived sources for maximum coverage.
• Select subdomains-top1million-5000.txt for rapid 5,000-entry scans or regional lists like subdomains-spanish.txt for locale-specific targeting.
• Feed these lists into massdns, dnsx, amass, or sublist3r via local paths or raw GitHub URLs to execute brute-force and resolution-based enumeration.

Frequently Asked Questions

What is the difference between combined_subdomains.txt and the top1million lists?

The combined_subdomains.txt file merges multiple public sources (Bitquark, Shubs, and Cloudflare data) into a single deduplicated master list containing over 150,000 entries. The subdomains-top1million-*.txt files are subsets derived specifically from a Cloudflare zone-transfer dump, segmented by volume (5,000, 20,000, 110,000) to provide smaller, faster alternatives for time-constrained testing.

Which SecLists wordlist should I use for a quick penetration test?

For time-boxed engagements or quick sanity checks, use Discovery/DNS/subdomains-top1million-5000.txt. Its small size allows massdns or dnsx to complete resolution within minutes while still covering the statistically most common subdomain patterns.

How were the SecLists DNS wordlists generated?

According to Discovery/DNS/README.md, the top-1 million lists were generated from a Cloudflare zone-transfer dataset dated January 2026, filtering for subdomains that appeared at least twice in the dataset to reduce noise. The combined list incorporates additional curated sources to expand coverage beyond the Cloudflare dataset alone.

Can I use these wordlists with tools other than massdns?

Yes. The SecLists DNS wordlists are plain-text files compatible with any subdomain enumeration tool that accepts wordlist input, including dnsx, amass, sublist3r, dnsrecon, and gobuster. Simply specify the file path or URL via the tool's respective wordlist flag (e.g., -w for amass and sublist3r, -l for dnsx).

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}