# Using SecLists for Subdomain Enumeration: A Complete Guide

> Master subdomain enumeration with SecLists. Discover curated wordlists for massdns dnsx and amass in this comprehensive guide for security assessments.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: how-to-guide
- Published: 2026-03-03

---

**TLDR:** SecLists provides curated subdomain wordlists in `Discovery/DNS/` that integrate with tools like **massdns**, **dnsx**, and **amass** to brute-force or resolve potential subdomains during security assessments.

SecLists, maintained by Daniel Miessler, is the security industry's standard repository for wordlists used in penetration testing and bug bounty hunting. For **subdomain enumeration**, the collection offers specialized DNS wordlists derived from real-world data sources including Cloudflare zone transfers and the Bitquark subdomain study. These lists range from lightweight 5,000-entry sets for quick scans to comprehensive combined lists exceeding 150,000 entries.

## DNS Wordlist Locations in SecLists

All subdomain-related wordlists reside in the `Discovery/DNS/` directory of the repository. According to the [`Discovery/DNS/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/README.md), these files are organized by data source and size to support different testing scenarios.

### The Combined Master List

The [`Discovery/DNS/combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/combined_subdomains.txt) file serves as the primary comprehensive wordlist. As implemented in danielmiessler/SecLists, this file merges the most popular public subdomain sources—including Bitquark, Shubs, and Cloudflare-derived datasets—while removing duplicates and adding supplementary entries. This combined approach yields approximately 150,000+ unique subdomains suitable for thorough enumeration against large organizational targets.

### Top-N Size-Tiered Lists

For scenarios requiring speed over coverage, SecLists provides subsets from the Cloudflare zone-transfer data (January 2026) in varying sizes:

- [`subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-5000.txt) – 5,000 most common entries for rapid sanity checks
- [`subdomains-top1million-20000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-20000.txt) – 20,000 entries balancing speed and coverage
- [`subdomains-top1million-110000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-110000.txt) – 110,000 entries for deeper initial scans

The README notes that the full `.7z` archive contains the complete million-entry dataset restricted to subdomains that appeared at least twice in the zone transfer, ensuring higher probability candidates.

### Regional and Language-Specific Lists

Beyond English-centric datasets, the repository includes targeted lists such as [`subdomains-spanish.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-spanish.txt) and [`subdomains-italian.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-italian.txt). These support localized assessments where regional naming conventions differ from standard English patterns.

## Selecting the Optimal Wordlist Strategy

Choosing the correct SecLists wordlist depends on your time constraints and target scope:

**Quick Reconnaissance:** Use [`subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-5000.txt) when performing fast sanity checks or when bandwidth/resolution time is limited. The small footprint minimizes DNS query volume while catching the most statistically common subdomains.

**Comprehensive Audits:** Deploy [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) for full-scale penetration tests against enterprise environments. The merged nature eliminates redundancy between Bitquark and Cloudflare sources while incorporating additional curated entries.

**Geographic Targeting:** Select language-specific files like [`subdomains-spanish.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-spanish.txt) when assessing organizations with regional presence or non-English primary operations.

## Integration with Enumeration Tools

SecLists wordlists integrate seamlessly with standard DNS brute-forcing and resolution tools. The following examples assume you have cloned the repository to `/opt/SecLists/`.

### High-Performance Brute-Forcing with massdns

Use **massdns** with the 5,000-entry list for rapid initial enumeration:

```bash
massdns -r /usr/local/etc/resolvers.txt -t A -q -w results.txt \
  /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

```

### Resolution and Verification with dnsx

The **dnsx** tool from ProjectDiscovery efficiently processes the combined list while handling retries and wildcard filtering:

```bash
dnsx -l /opt/SecLists/Discovery/DNS/combined_subdomains.txt \
     -silent -resp -retry 2 -o verified_subdomains.txt

```

### Deep Enumeration with Amass

**Amass** leverages SecLists to augment its passive sources with active brute-forcing:

```bash
amass enum -d example.com \
           -w /opt/SecLists/Discovery/DNS/combined_subdomains.txt \
           -o amass_results.txt

```

### Targeted Scanning with Sublist3r

For direct brute-force integration with **Sublist3r**, specify the larger 110,000-entry list:

```bash
sublist3r -d example.com \
          -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt \
          -o sublist3r_output.txt

```

## Data Provenance and Quality Assurance

The [`Discovery/DNS/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/README.md) documents the methodology behind these lists. The top-1M datasets originate from a Cloudflare zone-transfer dump conducted in January 2026, filtered to include only subdomains observed at least twice. This statistical filtering reduces noise from single-occurrence entries while maintaining high-value targets. The Bitquark source ([`bitquark-subdomains-top100000.txt`](https://github.com/danielmiessler/SecLists/blob/main/bitquark-subdomains-top100000.txt)) provides an independent dataset based on passive DNS collection, creating diversity when merged into the combined list.

## Summary

- SecLists stores subdomain wordlists in `Discovery/DNS/` with options ranging from 5,000 to 150,000+ entries
- [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) merges Bitquark, Shubs, and Cloudflare sources for comprehensive coverage
- Size-tiered lists ([`subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-top1million-5000.txt), etc.) allow you to balance scan speed against thoroughness
- Regional variants support non-English target environments
- All lists integrate with standard tools including **massdns**, **dnsx**, **amass**, and **sublist3r**

## Frequently Asked Questions

### Which SecLists wordlist is best for fast subdomain scans?

Use [`Discovery/DNS/subdomains-top1million-5000.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/subdomains-top1million-5000.txt) for rapid reconnaissance. This 5,000-entry list contains the most statistically common subdomains from the Cloudflare dataset, allowing **massdns** or **dnsx** to complete scans against single targets in seconds while conserving bandwidth.

### How does combined_subdomains.txt differ from individual source lists?

The [`combined_subdomains.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_subdomains.txt) file in `Discovery/DNS/` merges the Bitquark top 100,000, Shubs datasets, and Cloudflare-derived entries while deduplicating results and adding curated additions. This produces a more comprehensive set than any single source alone, typically exceeding 150,000 unique entries compared to the standalone Bitquark or 110,000-entry Cloudflare lists.

### Can I use these wordlists for languages other than English?

Yes. SecLists provides language-specific variants such as [`subdomains-spanish.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-spanish.txt) and [`subdomains-italian.txt`](https://github.com/danielmiessler/SecLists/blob/main/subdomains-italian.txt) within `Discovery/DNS/`. These contain regionally common subdomain patterns that differ from English defaults, improving hit rates when assessing organizations with primary operations in those language zones.

### What resolution tools work best with SecLists for DNS brute-forcing?

**massdns** excels at high-speed brute-forcing with smaller SecLists files like the 5,000-entry list, while **dnsx** handles larger wordlists efficiently with built-in wildcard filtering. **Amass** integrates SecLists as brute-force supplements to its passive gathering, and **sublist3r** accepts direct wordlist paths for straightforward enumeration workflows.