Using SecLists for Subdomain Enumeration: A Complete Guide

TLDR: SecLists provides curated subdomain wordlists in Discovery/DNS/ that integrate with tools like massdns, dnsx, and amass to brute-force or resolve potential subdomains during security assessments.

SecLists, maintained by Daniel Miessler, is the security industry's standard repository for wordlists used in penetration testing and bug bounty hunting. For subdomain enumeration, the collection offers specialized DNS wordlists derived from real-world data sources including Cloudflare zone transfers and the Bitquark subdomain study. These lists range from lightweight 5,000-entry sets for quick scans to comprehensive combined lists exceeding 150,000 entries.

DNS Wordlist Locations in SecLists

All subdomain-related wordlists reside in the Discovery/DNS/ directory of the repository. According to the Discovery/DNS/README.md, these files are organized by data source and size to support different testing scenarios.

The Combined Master List

The Discovery/DNS/combined_subdomains.txt file serves as the primary comprehensive wordlist. As implemented in danielmiessler/SecLists, this file merges the most popular public subdomain sources—including Bitquark, Shubs, and Cloudflare-derived datasets—while removing duplicates and adding supplementary entries. This combined approach yields approximately 150,000+ unique subdomains suitable for thorough enumeration against large organizational targets.

Top-N Size-Tiered Lists

For scenarios requiring speed over coverage, SecLists provides subsets from the Cloudflare zone-transfer data (January 2026) in varying sizes:

• subdomains-top1million-5000.txt – 5,000 most common entries for rapid sanity checks
• subdomains-top1million-20000.txt – 20,000 entries balancing speed and coverage
• subdomains-top1million-110000.txt – 110,000 entries for deeper initial scans

The README notes that the full .7z archive contains the complete million-entry dataset restricted to subdomains that appeared at least twice in the zone transfer, ensuring higher probability candidates.

Regional and Language-Specific Lists

Beyond English-centric datasets, the repository includes targeted lists such as subdomains-spanish.txt and subdomains-italian.txt. These support localized assessments where regional naming conventions differ from standard English patterns.

Selecting the Optimal Wordlist Strategy

Choosing the correct SecLists wordlist depends on your time constraints and target scope:

Quick Reconnaissance: Use subdomains-top1million-5000.txt when performing fast sanity checks or when bandwidth/resolution time is limited. The small footprint minimizes DNS query volume while catching the most statistically common subdomains.

Comprehensive Audits: Deploy combined_subdomains.txt for full-scale penetration tests against enterprise environments. The merged nature eliminates redundancy between Bitquark and Cloudflare sources while incorporating additional curated entries.

Geographic Targeting: Select language-specific files like subdomains-spanish.txt when assessing organizations with regional presence or non-English primary operations.

Integration with Enumeration Tools

SecLists wordlists integrate seamlessly with standard DNS brute-forcing and resolution tools. The following examples assume you have cloned the repository to /opt/SecLists/.

High-Performance Brute-Forcing with massdns

Use massdns with the 5,000-entry list for rapid initial enumeration:

massdns -r /usr/local/etc/resolvers.txt -t A -q -w results.txt \
  /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

Resolution and Verification with dnsx

The dnsx tool from ProjectDiscovery efficiently processes the combined list while handling retries and wildcard filtering:

dnsx -l /opt/SecLists/Discovery/DNS/combined_subdomains.txt \
     -silent -resp -retry 2 -o verified_subdomains.txt

Deep Enumeration with Amass

Amass leverages SecLists to augment its passive sources with active brute-forcing:

amass enum -d example.com \
           -w /opt/SecLists/Discovery/DNS/combined_subdomains.txt \
           -o amass_results.txt

Targeted Scanning with Sublist3r

For direct brute-force integration with Sublist3r, specify the larger 110,000-entry list:

sublist3r -d example.com \
          -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt \
          -o sublist3r_output.txt

Data Provenance and Quality Assurance

The Discovery/DNS/README.md documents the methodology behind these lists. The top-1M datasets originate from a Cloudflare zone-transfer dump conducted in January 2026, filtered to include only subdomains observed at least twice. This statistical filtering reduces noise from single-occurrence entries while maintaining high-value targets. The Bitquark source (bitquark-subdomains-top100000.txt) provides an independent dataset based on passive DNS collection, creating diversity when merged into the combined list.

Summary

• SecLists stores subdomain wordlists in Discovery/DNS/ with options ranging from 5,000 to 150,000+ entries
• combined_subdomains.txt merges Bitquark, Shubs, and Cloudflare sources for comprehensive coverage
• Size-tiered lists (subdomains-top1million-5000.txt, etc.) allow you to balance scan speed against thoroughness
• Regional variants support non-English target environments
• All lists integrate with standard tools including massdns, dnsx, amass, and sublist3r

Frequently Asked Questions

Which SecLists wordlist is best for fast subdomain scans?

Use Discovery/DNS/subdomains-top1million-5000.txt for rapid reconnaissance. This 5,000-entry list contains the most statistically common subdomains from the Cloudflare dataset, allowing massdns or dnsx to complete scans against single targets in seconds while conserving bandwidth.

How does combined_subdomains.txt differ from individual source lists?

The combined_subdomains.txt file in Discovery/DNS/ merges the Bitquark top 100,000, Shubs datasets, and Cloudflare-derived entries while deduplicating results and adding curated additions. This produces a more comprehensive set than any single source alone, typically exceeding 150,000 unique entries compared to the standalone Bitquark or 110,000-entry Cloudflare lists.

Can I use these wordlists for languages other than English?

Yes. SecLists provides language-specific variants such as subdomains-spanish.txt and subdomains-italian.txt within Discovery/DNS/. These contain regionally common subdomain patterns that differ from English defaults, improving hit rates when assessing organizations with primary operations in those language zones.

What resolution tools work best with SecLists for DNS brute-forcing?

massdns excels at high-speed brute-forcing with smaller SecLists files like the 5,000-entry list, while dnsx handles larger wordlists efficiently with built-in wildcard filtering. Amass integrates SecLists as brute-force supplements to its passive gathering, and sublist3r accepts direct wordlist paths for straightforward enumeration workflows.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}