# How to Perform DNS Reconnaissance and Subdomain Discovery Using The Book of Secret Knowledge

> Master DNS reconnaissance and subdomain discovery using nine open-source tools curated in the-book-of-secret-knowledge. Learn comprehensive workflows for effective security assessments.

- Repository: [Michał Ży/the-book-of-secret-knowledge](https://github.com/trimstray/the-book-of-secret-knowledge)
- Tags: how-to-guide
- Published: 2026-02-24

---

**This guide explains how to chain nine specialized open-source tools—from dnsdiag to dnsperf—to execute comprehensive DNS reconnaissance and subdomain discovery workflows as curated in trimstray/the-book-of-secret-knowledge.**

The repository `trimstray/the-book-of-secret-knowledge` maintains a curated index of security utilities in its [`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md), including a complete arsenal for mapping DNS infrastructure and discovering subdomains. By combining passive intelligence gathering with active brute-force techniques, you can systematically enumerate target domains while maintaining operational efficiency.

## DNS Diagnostics and Health Checking

Before launching large-scale enumeration, verify that target name servers respond correctly and measure baseline latency.

### Verify Name Server Health with dnsdiag

Use **dnsdiag** to troubleshoot authoritative servers and detect misconfigurations. This diagnostic step prevents false negatives during later brute-force stages by confirming that DNS infrastructure is responsive and consistent.

Run a basic health check against your target domain:

```bash
dnsdiag "example.com" > dnsdiag.txt

```

This command captures response times and record consistency, providing a sanity check before you initiate heavy enumeration traffic.

## Passive Subdomain Discovery

Start with passive techniques that query public data sources without directly contacting the target's infrastructure.

### Harvest Subdomains from Public Sources with Subfinder

**Subfinder** excels at ultra-fast passive discovery using certificate transparency logs, search engines, and archives. It requires no wordlist and generates minimal network traffic, making it ideal for stealth reconnaissance.

Execute passive collection with:

```bash
subfinder -d "example.com" -silent > subfinder_passive.txt

```

The `-d` flag specifies the target domain, while `-silent` outputs only discovered subdomains without metadata clutter.

### Deep Passive and Active Enumeration with Amass

For comprehensive coverage, **Amass** combines passive data aggregation with active DNS queries and web crawling. It integrates certificate transparency, WHOIS, and ASN information to surface deep infrastructure relationships.

Launch both passive and active modes:

```bash
amass enum -d "example.com" -passive -active -nolocaldb -o amass.txt

```

The `enum` subcommand starts discovery, `-passive -active` enables both techniques, and `-nolocaldb` prevents local database storage for ephemeral operations.

## Active Subdomain Enumeration

After exhausting passive sources, actively query DNS servers with generated candidate lists.

### High-Performance Bulk Resolution with massdns

**massdns** functions as a fast DNS stub resolver capable of handling thousands of queries per second. Use it to resolve large candidate lists generated by other tools or custom wordlists.

Resolve combined results using a public resolver list:

```bash
massdns -r /path/to/resolvers.txt -t A -o S combined.txt > massdns_resolved.txt

```

The `-r` flag points to your resolver list, `-t A` queries for A records, and `-o S` produces simple output format showing name-to-IP mappings.

### Wordlist-Based Brute-Force with Sublist3r and Knock

When passive sources miss edge-case subdomains, employ active brute-force with curated wordlists.

**Sublist3r** performs active enumeration with built-in wordlist support:

```bash
sublist3r -d "example.com" -w /usr/share/wordlists/subdomains.txt -o sublist3r.txt

```

Alternatively, **knock** provides a lightweight Python implementation for reading wordlists and querying each candidate directly against target name servers. Both tools fill gaps left by passive discovery when internal naming conventions follow predictable patterns.

## Permutation and Typo-Squatting Detection

Expand your reconnaissance to detect phishing vectors and brand impersonation.

### Generate Domain Permutations with dnstwist

**dnstwist** creates permutations of your target domain using bitsquatting, homoglyph substitution, and character insertion to uncover look-alike domains used in phishing campaigns.

Analyze your discovered subdomain list for potential typo-squatting:

```bash
dnstwist -d "example.com" -w final_subdomains.txt -o dnstwist.txt

```

The `-w` flag accepts your previously discovered host list, comparing each entry against generated permutations to surface malicious variants.

## Performance Validation and Benchmarking

After completing enumeration, validate the impact of your queries on target infrastructure.

### Stress Test Name Servers with dnsperf

**dnsperf** measures DNS query performance and server capacity under load. Use it to benchmark authoritative servers using your final subdomain list as query input.

First format your subdomain list for dnsperf:

```bash
awk '{print "A",$0}' final_subdomains.txt > queries.txt

```

Then execute the benchmark against target name servers:

```bash
dnsperf -s $(dig +short NS "example.com" | tr '\n' ',') -l 30 -Q 1000 -f queries.txt > dnsperf.txt

```

The `-s` flag accepts comma-separated name server IPs, `-l 30` sets a 30-second test duration, and `-Q 1000` limits queries to 1000 per second.

## Complete DNS Reconnaissance Workflow

Combine all stages into a single automated pipeline. This script implements the full methodology referenced in the [`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) of trimstray/the-book-of-secret-knowledge:

```bash
#!/usr/bin/env bash
TARGET="example.com"
OUTDIR="dns-recon-output"
mkdir -p "$OUTDIR"

# 1. Basic health check

dnsdiag "$TARGET" > "$OUTDIR/dnsdiag.txt"

# 2. Passive subdomain discovery

subfinder -d "$TARGET" -silent > "$OUTDIR/subfinder_passive.txt"

# 3. Active enumeration with Amass

amass enum -d "$TARGET" -passive -active -nolocaldb -o "$OUTDIR/amass.txt"

# 4. Combine passive results

cat "$OUTDIR/subfinder_passive.txt" "$OUTDIR/amass.txt" | sort -u > "$OUTDIR/combined.txt"

# 5. Resolve candidates quickly

massdns -r /path/to/resolvers.txt -t A -o S "$OUTDIR/combined.txt" > "$OUTDIR/massdns_resolved.txt"

# 6. Brute-force with wordlist

sublist3r -d "$TARGET" -w /usr/share/wordlists/subdomains.txt -o "$OUTDIR/sublist3r.txt"

# 7. Merge all discoveries

cat "$OUTDIR/massdns_resolved.txt" "$OUTDIR/sublist3r.txt" | sort -u > "$OUTDIR/final_subdomains.txt"

# 8. Detect typo-squatting

dnstwist -d "$TARGET" -w "$OUTDIR/final_subdomains.txt" -o "$OUTDIR/dnstwist.txt"

# 9. Benchmark name servers

awk '{print "A",$0}' "$OUTDIR/final_subdomains.txt" > "$OUTDIR/queries.txt"
dnsperf -s $(dig +short NS "$TARGET" | tr '\n' ',') -l 30 -Q 1000 -f "$OUTDIR/queries.txt" > "$OUTDIR/dnsperf.txt"

```

This workflow progresses from passive intelligence gathering to active validation, ensuring comprehensive coverage while respecting target infrastructure capacity.

## Summary

- The [`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) in trimstray/the-book-of-secret-knowledge indexes nine specialized tools that form a complete DNS reconnaissance pipeline.
- **dnsdiag** validates name server health before enumeration begins, preventing false negatives.
- **subfinder** and **Amass** handle passive discovery using certificate transparency logs and search engines without direct target contact.
- **massdns** resolves thousands of candidates per second, while **sublist3r** and **knock** perform targeted brute-force against specific wordlists.
- **dnstwist** extends reconnaissance to phishing detection by generating domain permutations.
- **dnsperf** validates infrastructure capacity after enumeration, ensuring operational safety.

## Frequently Asked Questions

### What is the difference between passive and active subdomain discovery?

Passive discovery uses third-party data sources like certificate transparency logs, search engines, and DNS aggregators without querying the target directly. **subfinder** and **Amass** in passive mode operate this way. Active discovery sends DNS queries directly to target name servers using generated candidate lists, as performed by **massdns**, **knock**, and **sublist3r**. Passive techniques are stealthier but may miss internal or non-public subdomains, while active techniques provide comprehensive coverage but generate detectable traffic.

### How do I choose between massdns and knock for subdomain enumeration?

Use **massdns** when you have a large candidate list (thousands of entries) requiring high-speed resolution, as it implements a fast asynchronous DNS stub resolver capable of handling massive concurrency. Use **knock** or **sublist3r** when you need simple wordlist-based enumeration with moderate speed or when targeting specific naming conventions with custom lists. **massdns** excels at verifying existing lists, while **knock** provides straightforward brute-force without external dependencies.

### Can these tools detect malicious typo-squatting domains?

Yes. **dnstwist** specifically generates domain permutations using bitsquatting, homoglyph substitution, and character omission to identify look-alike domains commonly used in phishing. When you feed your discovered subdomain list into **dnstwist** using the `-w` flag, it compares your legitimate assets against potential impersonation domains, helping security teams identify brand infringement and malicious infrastructure before it impacts users.

### Where are these DNS tools documented in the repository?

All tools are indexed in the [`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) file at the root of trimstray/the-book-of-secret-knowledge. The repository does not store the actual tool source code internally; instead, it provides authoritative upstream links to **dnsdiag**, **subfinder**, **sublist3r**, **Amass**, **massdns**, **knock**, **dnstwist**, and **dnsperf**, ensuring you always access the latest stable versions directly from their respective maintainers.